How to implement authentication in Replit apps

1// Replit Auth - read user info from request headers
2import express from 'express';
3
4const app = express();
5
6// Replit Auth sends user data via headers
7app.get('/api/me', (req, res) => {
8  const userId = req.headers['x-replit-user-id'];
9  const userName = req.headers['x-replit-user-name'];
10  const userRoles = req.headers['x-replit-user-roles'];
11  const profileImage = req.headers['x-replit-user-profile-image'];
12
13  if (!userId) {
14    return res.status(401).json({ error: 'Not logged in' });
15  }
16
17  res.json({
18    id: userId,
19    name: userName,
20    roles: userRoles,
21    profileImage,
22  });
23});
24
25// Frontend login button (add to your HTML/React)
26// <script authed="location.reload()" src="https://auth.util.repl.co/script.js"></script>

1import express from 'express';
2import session from 'express-session';
3import passport from 'passport';
4import { Strategy as GoogleStrategy } from 'passport-google-oauth20';
5
6const app = express();
7
8// Session configuration
9app.use(session({
10  secret: process.env.SESSION_SECRET,
11  resave: false,
12  saveUninitialized: false,
13  cookie: {
14    secure: process.env.REPLIT_DEPLOYMENT === '1',
15    maxAge: 24 * 60 * 60 * 1000, // 24 hours
16  },
17}));
18
19app.use(passport.initialize());
20app.use(passport.session());
21
22// Google OAuth strategy
23passport.use(new GoogleStrategy({
24  clientID: process.env.GOOGLE_CLIENT_ID,
25  clientSecret: process.env.GOOGLE_CLIENT_SECRET,
26  callbackURL: '/auth/google/callback',
27}, (accessToken, refreshToken, profile, done) => {
28  // Save or find user in database
29  const user = {
30    id: profile.id,
31    name: profile.displayName,
32    email: profile.emails?.[0]?.value,
33    avatar: profile.photos?.[0]?.value,
34  };
35  done(null, user);
36}));
37
38passport.serializeUser((user, done) => done(null, user));
39passport.deserializeUser((user, done) => done(null, user));

1// Auth routes
2app.get('/auth/google',
3  passport.authenticate('google', { scope: ['profile', 'email'] })
4);
5
6app.get('/auth/google/callback',
7  passport.authenticate('google', { failureRedirect: '/login' }),
8  (req, res) => res.redirect('/')
9);
10
11app.get('/auth/logout', (req, res) => {
12  req.logout((err) => {
13    if (err) console.error('Logout error:', err);
14    res.redirect('/');
15  });
16});
17
18// Auth check middleware
19function requireAuth(req, res, next) {
20  if (req.isAuthenticated()) return next();
21  res.status(401).json({ error: 'Authentication required' });
22}
23
24// Protected route
25app.get('/api/profile', requireAuth, (req, res) => {
26  res.json(req.user);
27});
28
29// Check auth status (for frontend)
30app.get('/api/auth/status', (req, res) => {
31  res.json({
32    authenticated: req.isAuthenticated(),
33    user: req.user || null,
34  });
35});

1// Dynamic callback URL based on environment
2const callbackURL = process.env.REPLIT_DEPLOYMENT === '1'
3  ? `https://${process.env.REPLIT_DOMAINS}/auth/google/callback`
4  : `https://${process.env.REPLIT_DEV_DOMAIN}/auth/google/callback`;
5
6passport.use(new GoogleStrategy({
7  clientID: process.env.GOOGLE_CLIENT_ID,
8  clientSecret: process.env.GOOGLE_CLIENT_SECRET,
9  callbackURL,
10}, strategyCallback));