// the take
A small Restify plugin implementing just the OAuth 2.0 Client Credentials and Resource Owner Password Credentials grant flows, with the actual client/token storage left entirely to hooks you provide. It's aimed at people already committed to Restify who want the token endpoint wire protocol handled for them without pulling in a full OAuth provider.
The scope is genuinely narrow and well thought out: it only handles the HTTP-level ceremony (token endpoint shape, error responses, WWW-Authenticate/Link headers) and pushes all credential/token logic to hooks, so you're not fighting someone else's storage assumptions. The hook contract (grantClientToken, authenticateToken, grantScopes) is simple and maps cleanly onto RFC 6749/6750 without hiding the spec behind abstractions. Good test coverage for a project this size, with separate unit and integration suites per flow.
No commits since 2017 and it's written in CoffeeScript, which is itself a sign of age and will deter contributors even if someone wanted to pick it up. It's tied to Restify, a framework whose own momentum has faded hard since Node's ecosystem moved to Express/Fastify/Koa, so you'd be stacking two aging dependencies. Only two of the four core OAuth 2 grant types are implemented — no authorization code or implicit flow, so it's a non-starter for anything needing browser-based login. No refresh token support at all; tokenExpirationTime is purely cosmetic since you're on your own for actually expiring and rotating tokens.
We read the README, the directory tree and a key source file in October 2026. Nobody pays to be listed. How we judge →