An SDK for using FusionAuth in Angular applications.

Table of Contents

• Overview
• Getting Started
• Quickstart
• Installation
• Usage
• FusionAuthService
• Pre-built buttons
• State Parameter
• SSR
• DPoP Mode
• Known issues
• Documentation
• Releases

Overview

This SDK helps manage authentication state for your Angular app and provides functionality to login, register, and logout users. It also can be configured to automatically manage your refresh token.

Your users will be sent to FusionAuth’s themeable hosted login pages and then log in. After that, they are sent back to your Angular application.

Once authentication succeeds, the following secure, HTTP-only cookies will be set:

• app.at - an OAuth Access Token

• app.rt - a Refresh Token used to obtain a new app.at. This cookie will only be set if refresh tokens are enabled on your FusionAuth instance.

The access token can be presented to APIs to authorize the request and the refresh token can be used to get a new access token.

There are 2 ways to interact with this SDK:

1. By hosting your own server that performs the OAuth token exchange and meets the server code requirements for FusionAuth Web SDKs.
2. By using the server hosted on your FusionAuth instance, i.e., not writing your own server code.

If you are hosting your own server, see server code requirements.

You can use this library against any version of FusionAuth or any OIDC compliant identity server.

Getting Started

If you are new to Angular development, you may want to start with the Quickstart guide. If you are already familiar with Angular development, skip to the Installation section.

Quickstart

See the FusionAuth Angular Quickstart for a full tutorial on using FusionAuth and Angular.

Installation

NPM:

npm install @fusionauth/angular-sdk

Yarn:

yarn add @fusionauth/angular-sdk

Configuring FusionAuthModule

import { NgModule } from '@angular/core';
import { BrowserModule } from '@angular/platform-browser';

import { AppRoutingModule } from './app-routing.module';
import { FusionAuthModule } from '@fusionauth/angular-sdk';

@NgModule({
  declarations: [],
  imports: [
    FusionAuthModule.forRoot({
      clientId: '', // Your FusionAuth client ID
      serverUrl: '', // The base URL of the server that performs the token exchange
      redirectUri: '', // The URI that the user is directed to after the login/register/logout action
      shouldAutoRefresh: true // option to configure the SDK to automatically handle token refresh. Defaults to false if not specified here.
      // useDpop: true, // Opt-in to DPoP mode. See "DPoP Mode" below. Defaults to false.
    }),
  ],
  providers: [],
  bootstrap: []
})
export class AppModule { }

Usage

FusionAuthService

The injectable FusionAuthService class provides observable properties to which components may subscribe.

Note, you can also use the non-observable getUserInfo method if you wish to implement your observables.

class AppComponent implements OnInit, OnDestroy {
  private fusionAuthService: FusionAuthService = inject(FusionAuthService);

  isLoggedIn: boolean = this.fusionAuthService.isLoggedIn();
  userInfo: UserInfo | null = null;
  isGettingUserInfo: boolean = false;
  subscription?: Subscription;

  ngOnInit(): void {
    if (this.isLoggedIn) {
      this.subscription = this.fusionAuthService
        .getUserInfoObservable({
          onBegin: () => (this.isGettingUserInfo = true),
          onDone: () => (this.isGettingUserInfo = false),
        })
        .subscribe({
          next: (userInfo) => (this.userInfo = userInfo),
          error: (error) => console.error(error),
        });
    }
  }

  ngOnDestroy(): void {
    this.subscription?.unsubscribe();
  }
}

Pre-built buttons

There are three pre-styled buttons that are configured to perform login/logout/registration. They can be placed anywhere in your app as is.

import { Component } from '@angular/core';

@Component({
  selector: 'app-login',
  template: `<fa-login></fa-login>`,
  styleUrls: []
})
export class LoginComponent {}

@Component({
  selector: 'app-logout',
  template: `<fa-logout></fa-logout>`,
  styleUrls: []
})
export class LogoutComponent {}

@Component({
  selector: 'app-register',
  template: `<fa-register></fa-register>`,
  styleUrls: []
})
export class RegisterComponent {}

State parameter

The startLogin and startRegistration functions both accept an optional string parameter called state. The login and register components can also be passed the state as an input. The state that is passed in to the function call will be echoed back in the state query parameter of the callback uri specified in redirectUri on the FusionAuthConfig used to initialize the FusionAuthModule. Though you may pass any value you would like for the state parameter, it is often used to indicate which page the user was on before redirecting to login or registration, so that the user can be returned to that location after a successful authentication.

SSR

The SDK supports Angular applications using SSR. No additional configuration is needed.

DPoP Mode

By default, the SDK calls a Hosted Backend that stores tokens in HttpOnly cookies (useDpop: false, the default). In DPoP mode, the SDK instead calls FusionAuth endpoints directly and binds tokens to a private key generated in the browser. Enable it by setting useDpop: true on FusionAuthConfig:

FusionAuthModule.forRoot({
  clientId: '',
  serverUrl: '',
  redirectUri: '',
  useDpop: true, // Opt-in to DPoP mode.
  dpopTokenStorage: 'localStorage', // 'localStorage' (default, persists across reloads) or 'memory'.
}),

When useDpop: true, FusionAuthService additionally exposes dpopFetch(), generateProof(), and getAccessToken(). These throw a descriptive error if called when useDpop is not enabled.

class AppComponent {
  private fusionAuthService: FusionAuthService = inject(FusionAuthService);

  async callApi() {
    // Recommended — handles attaching DPoP headers (and nonce retries) automatically.
    const response = await this.fusionAuthService.dpopFetch('https://api.example.com/data', { method: 'GET' });

    // For axios or other HTTP libraries that can't use dpopFetch.
    const accessToken = this.fusionAuthService.getAccessToken();
    const proof = await this.fusionAuthService.generateProof('https://api.example.com/data', 'GET', accessToken ?? undefined);
    // axios.get('https://api.example.com/data', {
    //   headers: { Authorization: `DPoP ${accessToken}`, DPoP: proof }
    // });
  }
}

Known Issues

None.

Documentation

Full library documentation

Use backticks for code in this readme. This readme is included on the FusionAuth website, and backticks show the code in the best light there.

Releases

To perform a release to NPM, create a release on GitHub. That will automatically publish a release to GitHub.