Nuxt Auth Utils Skilld

atinux/nuxt-auth-utils nuxt-auth-utils

Version: 0.5.28 (Feb 2026) Deps: @adonisjs/hash@^9.1.1, @nuxt/kit@^4.3.1, defu@^6.1.4, h3@^1.15.4, hookable@^6.0.1, jose@^6.1.3, ofetch@^1.5.1, openid-client@^6.8.2, pathe@^2.0.3, scule@^1.3.0, uncrypto@^0.1.3 Tags: latest: 0.5.29 (Feb 2026)

References: package.json — exports, entry points • README — setup, basic usage • GitHub Issues — bugs, workarounds, edge cases • Releases — changelog, breaking changes, new APIs

Search

Use skilld search instead of grepping .skilld/ directories — hybrid semantic + keyword search across all indexed docs, issues, and releases. If skilld is unavailable, use npx -y skilld search.

skilld search "query" -p nuxt-auth-utils
skilld search "issues:error handling" -p nuxt-auth-utils
skilld search "releases:deprecated" -p nuxt-auth-utils

Filters: docs:, issues:, releases: prefix narrows by source type.

API Changes

This section documents version-specific API changes — prioritize recent major/minor releases.

• BREAKING: oicd renamed to oidc in OAuthProvider type — v0.5.28 corrected typo in provider type name source

• BREAKING: OIDC provider requires PKCE and nonce — v0.5.28 made these mandatory per OAuth specs (previously optional) source

• NEW: aaguid exposed on WebAuthn credentials — v0.5.27 added aaguid property to credentials in onSuccess callback, use to identify authenticator type with community AAGUIDS list source

• NEW: OpenID Connect (OIDC) provider — v0.5.27 added generic OIDC provider via defineOAuthOidcEventHandler, supports .well-known/openid-configuration auto-discovery source

• NEW: loadStrategy: 'none' option — v0.5.26 added ability to completely disable session fetching during SSR (added alongside existing 'client-only' option from v0.5.24) source

• NEW: passwordNeedsRehash() utility — v0.5.26 added server utility to check if password hash needs rehashing when scrypt settings change, call during login flow to trigger re-hash source

• NEW: loadStrategy: 'client-only' option — v0.5.24 added option to fetch session only client-side (not during SSR), useful with prerendered/cached routes source

• NEW: openInPopup(route, { width?, height? }) method on useUserSession — v0.5.11 added popup window OAuth flow with auto-close on success, pass optional size object to control window dimensions source

• NEW: WebSocket authentication support — v0.5.9 added requireUserSession() function for use in WebSocket upgrade handler to authenticate before connection, requires Nitro >= 2.9.7 source

• NEW: Session ID auto-generation — v0.5.12 added generated id field on session object for session tracking source

• BREAKING: WebAuthn dependency update — v0.5.0 updated simplewebauthn to v11, breaking changes in API (see simplewebauthn v11 migration) source

• BREAKING: useWebAuthn composable allowCredentials fix — v0.5.1 changed how allowCredentials and excludeCredentials are processed in useWebAuthn, previously had bugs with options handling source

• NEW: WebAuthn (passkey) support — v0.4.0 added defineWebAuthnRegisterEventHandler, defineWebAuthnAuthenticateEventHandler, useWebAuthn() composable, storeChallenge/getChallenge hooks for challenge management source

• NEW: hashPassword() and verifyPassword() utilities — v0.4.0 added server-side password hashing with scrypt, use in login/register flows for secure password storage source

• BREAKING: OAuth handler renaming — v0.4.0 renamed oauth<Provider>EventHandler to defineOAuth<Provider>EventHandler (e.g., defineOAuthGitHubEventHandler) source

Also changed: OIDC X provider PKCE flow fixed · Shopify Customer Account API provider · Bluesky (AT Protocol) provider · generated session ID available on session · multiple OAuth providers (Okta, Ory, Kick, Gitea, etc.)