passport-discord

passport-discord is a Passport.js strategy that authenticates users through Discord’s OAuth 2.0 API. It extends the generic passport-oauth2 strategy with Discord-specific defaults for the authorization and token endpoints, then normalizes the returned profile so the rest of a Node.js application can treat Discord sign-in the same way it treats any other Passport strategy.

Beyond the base identify scope, the strategy conditionally fetches a user’s connections and guilds data when those scopes were requested, and supports Discord-specific authorization parameters like permissions (for bot installs) and prompt. The package’s own README now flags it as archived and no longer maintained, pointing users toward community-maintained forks such as discord-strategy or passport-discord-auth.

What You Get

• A drop-in Passport strategy class preconfigured with Discord’s OAuth2 authorization and token URLs
• Automatic profile retrieval from Discord’s /users/@me endpoint after successful authentication
• Conditional fetching of guilds and connections data when those scopes are requested
• Support for Discord-specific authorization params (permissions for bot scope, prompt for re-consent)

Common Use Cases

• Adding “Login with Discord” to an Express app already using Passport for other providers
• Building a Discord bot dashboard that needs the owner to authenticate with their Discord account
• Requesting the guilds scope to let a user pick which server to install a bot into
• Combining with passport-oauth2-refresh to keep long-lived sessions authenticated against Discord

Under The Hood

Architecture The package is a minimal adapter layered on top of passport-oauth2: lib/index.js re-exports a single Strategy class defined in lib/strategy.js, which uses classic prototype inheritance (util.inherits) to extend OAuth2Strategy rather than delegating to it via composition. The constructor’s only job is to supply Discord’s default authorizationURL and tokenURL before handing control to the parent class, which owns the actual OAuth2 handshake, state, and token exchange via its internal _oauth2 client. The subclass overrides exactly two extension points the parent class expects: userProfile, which fetches /users/@me and then chains conditional requests to /users/@me/connections and /users/@me/guilds based on which scopes were granted, and authorizationParams, which forwards Discord-specific query params (permissions, prompt). There is no independent state or storage; every network call goes through the parent’s _oauth2.get.

Tech Stack The only runtime dependency is passport-oauth2 (^1.5.0), which itself wraps Node’s oauth package. There is no build step, bundler, or TypeScript — the package ships plain CommonJS written in pre-ES6 style (var, util.inherits, callback-passing style throughout). The bundled example/ directory demonstrates usage with Express, express-session, and passport, but that example has its own separate package.json and is not part of the published package.

Code Quality No test files, test framework, or CI configuration were found anywhere in the repository — the four-pass review found zero automated coverage for the OAuth flow or profile parsing. Error handling is present but inconsistent: userProfile correctly wraps upstream failures in InternalOAuthError, but checkScope’s nested callback chain calls done(errx) without an early return, so on an error from the connections or guilds fetch, execution can still fall through and invoke done a second time. Naming follows the conventions expected by passport-oauth2 and other Passport strategies (Strategy, userProfile, authorizationParams), and JSDoc-style comments document the public constructor, but there is no linter, formatter, or type checker configured.

API Design The public surface mirrors every other Passport OAuth2 strategy: construct with {clientID, clientSecret, callbackURL, scope} plus a verify callback, then call passport.authenticate('discord', {...}). Anyone who has wired up passport-github or a similar strategy can use this package with effectively no new concepts, and Discord-specific behavior (bot permissions, prompt) is exposed through the same options object rather than a separate API. The main gaps are the lack of shipped TypeScript typings and, per the package’s own README, that it is now archived and unmaintained, with the author pointing adopters toward actively maintained forks.