@ssojet/hono

Enterprise Authentication & OpenID Connect (OIDC) middleware for Hono

Authenticate users, protect routes, manage sessions, and add Enterprise SSO to your Hono application in minutes.

📚 Documentation: https://ssojet.com/docs

---

@ssojet/hono is the official SSOJet authentication middleware for Hono.

It provides everything needed to add OpenID Connect (OIDC) authentication, Enterprise Single Sign-On (SSO), secure session management, route protection, and user authentication to Hono applications.

Built entirely on Web Standards, the same package runs on:

• Node.js
• Bun
• Deno
• Cloudflare Workers
• Vercel Edge

without any runtime-specific code.

---

Features

• 🔐 OpenID Connect (OIDC) Authentication
• 🏢 Enterprise Single Sign-On (SAML & OIDC)
• 👤 Secure Session Management
• 🛡 Authentication Middleware
• 🔒 Route Protection
• 🔄 Automatic Access Token Refresh
• ⚡ Edge Runtime Compatible
• ☁️ Cloudflare Workers Support
• ▲ Vercel Edge Support
• 🦕 Deno Support
• 🥟 Bun Support
• 📦 Fully Typed TypeScript API
• 🚀 Zero Runtime Configuration

---

Why SSOJet?

Authentication should not require hundreds of lines of OAuth code.

@ssojet/hono handles:

• Login
• Callback handling
• Session cookies
• User authentication
• Access token refresh
• Route protection
• Enterprise SSO

so you can focus on building your application instead of identity infrastructure.

---

Quick Start

Install:

npm install @ssojet/hono hono

Configure your environment:

SSOJET_DOMAIN=your-tenant.auth.ssojet.com
SSOJET_CLIENT_ID=your-client-id
SSOJET_CLIENT_SECRET=your-client-secret
SSOJET_SESSION_ENCRYPTION_KEY=$(openssl rand -base64 32)
APP_BASE_URL=https://your-app.com

Register:

${APP_BASE_URL}/auth/callback

as an allowed callback URL in your SSOJet Dashboard.

Add the middleware:

import { Hono } from "hono";
import { ssojet, requiresAuth } from "@ssojet/hono";

const app = new Hono();

app.use("*", ssojet());

app.get("/", (c) =>
  c.var.ssojet.isAuthenticated
    ? c.html(`Welcome ${c.var.ssojet.user!.name}`)
    : c.html(`<a href="/auth/login">Login</a>`)
);

app.get("/profile",
  requiresAuth(),
  (c) => c.json(c.var.ssojet.user)
);

export default app;

That's it.

---

How it works

Browser
    │
    ▼
Hono Application
    │
@ssojet/hono
    │
    ▼
SSOJet Identity Platform
    │
    ▼
Okta • Microsoft Entra ID • Google Workspace • Auth0 • OneLogin

---

API

Function	Description
ssojet()	Mount authentication middleware
requiresAuth()	Protect authenticated routes
claimEquals()	Require a claim to equal a value
claimIncludes()	Require a role/group claim
getAccessToken()	Retrieve a valid access token (refreshes automatically)

The middleware automatically mounts:

GET /auth/login

GET /auth/callback

GET /auth/logout

and exposes

c.var.ssojet.user

c.var.ssojet.session

c.var.ssojet.isAuthenticated

inside every request.

---

Supported Runtimes

Runtime	Supported
Node.js 18+	✅
Bun	✅
Deno	✅
Cloudflare Workers	✅
Vercel Edge	✅

No runtime-specific configuration is required.

---

Common Use Cases

• Enterprise SSO
• OpenID Connect Authentication
• Multi-tenant SaaS
• Internal Admin Portals
• Customer Portals
• Organization Login
• Session Authentication
• Protected APIs
• RBAC
• B2B SaaS Authentication

---

Examples

Complete runnable applications are available for every supported runtime.

• Cloudflare Workers
• Node.js
• Bun
• Deno
• Vercel Edge

Examples:

examples/
├── bun
├── cloudflare-workers
├── deno
├── node
└── vercel-edge

---

Troubleshooting

Invalid Callback URL

Verify that

APP_BASE_URL/auth/callback

matches the callback URL configured in the SSOJet Dashboard.

---

Authentication fails

Verify:

• SSOJET_DOMAIN
• SSOJET_CLIENT_ID
• SSOJET_CLIENT_SECRET

---

Session not persisting

Ensure

SSOJET_SESSION_ENCRYPTION_KEY

is at least 32 characters.

---

Logout

/auth/logout currently clears the local application session.

When SSOJet exposes the OpenID Connect end_session_endpoint, full RP-Initiated Logout will work automatically without requiring any SDK changes.

---

Related SDKs

Looking for another framework?

• JavaScript SDK
• Node.js SDK
• Express SDK
• React SDK
• Next.js SDK
• Hono SDK

See the SSOJet GitHub organization for all official SDKs.

---

Contributing

Contributions are welcome.

Please open an issue before submitting a pull request to discuss significant changes.

---

Reporting Issues

Found a bug?

Please open an issue on GitHub.

Have a security issue?

Please report it privately through SSOJet instead of creating a public issue.

---

About SSOJet

SSOJet is a developer-first identity platform that helps B2B SaaS companies add enterprise authentication without rebuilding their existing login system.

With SSOJet you can integrate:

• Enterprise SSO (SAML & OIDC)
• SCIM Provisioning
• Directory Sync
• Organizations
• Multi-tenant Authentication
• Social Login
• MFA
• Passkeys
• User Management

Learn more:

https://ssojet.com

Documentation:

https://ssojet.com/docs

---

License

MIT License — see LICENSE.