sdk: OAuth 2.0 PKCE rewrite with React Native support

[rickyrombo]

Summary

• Rewrites sdk.oauth to use OAuth 2.0 Authorization Code Flow with PKCE — no backend or client secret required
• Removes the old implicit flow (Ethereum-signed JWT), init(), renderButton(), write_once scope, and associated callback types
• login() is now async and returns Promise<void>; errors surface via rejection instead of callbacks
• redirectUri can be set once in sdk({ redirectUri: '...' }) config and optionally overridden per login() call
• sdk.oauth is always defined — no null-check or ! assertion needed
• React Native / Expo now supported out of the box: AsyncStorage token persistence + expo-web-browser OAuth session, with the redirect handled automatically inside login()
• New methods: handleRedirect(), isAuthenticated(), getUser(), refreshAccessToken(), logout()
• Token auto-refresh middleware intercepts 401 responses and retries with a fresh token
• Updated docs and changeset

Test plan

• Web popup flow: login() resolves after user approves, getUser() returns profile
• Web full-page redirect flow: handleRedirect() completes exchange, getUser() returns profile
• Popup cancel: login() rejects with error
• isAuthenticated() returns true after login, false after logout()
• refreshAccessToken() returns a new token; auto-refresh fires on 401
• React Native: login() opens in-app browser and resolves after redirect

🤖 Generated with Claude Code

[changeset-bot]

🦋 Changeset detected

Latest commit: 11a62d7

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 4 packages

Name	Type
@audius/sdk	Major
@audius/sdk-legacy	Patch
@audius/protocol-dashboard	Patch
@audius/sp-actions	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[github-actions]

🌐 Web preview ready

Preview URL: https://audius-web-preview-pr-13924.audius.workers.dev

Unique preview for this PR (deployed from this branch).
Workflow run

[socket-security]

No dependency changes detected. Learn more about Socket for GitHub.

👍 No dependency changes detected in pull request

[Copilot]

Pull request overview

This PR rewrites the SDK’s OAuth implementation to use OAuth 2.0 Authorization Code Flow with PKCE, adds a token-store abstraction with web + React Native defaults, and updates docs/build wiring to support React Native/Expo.

Changes:

• Replace legacy implicit OAuth flow APIs with PKCE-based login()/handleRedirect() and async token-store-backed auth state.
• Introduce OAuthTokenStore interface plus TokenStoreMemory, TokenStoreLocalStorage, and TokenStoreAsyncStorage implementations with updated tests.
• Add React Native entrypoint (index.native.ts) and update docs/changeset/build config accordingly.

Reviewed changes

Copilot reviewed 30 out of 31 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
packages/sdk/src/sdk/utils/oauthScope.ts	Removes write_once param validation helper; scope validation now read/write only.
packages/sdk/src/sdk/types.ts	Adds tokenStore and openUrl to services; adds redirectUri to SDK config schemas.
packages/sdk/src/sdk/sdkBrowserDist.ts	Switches global browser dist export to use createSdk.
packages/sdk/src/sdk/sdk.ts	Removes runtime sdk export; keeps AudiusSdk type based on createSdk.
packages/sdk/src/sdk/oauth/types.ts	Restricts OAuth scopes to read/write and removes legacy result/params types.
packages/sdk/src/sdk/oauth/tokenStoreLocalStorage.test.ts	Adds tests for localStorage token persistence.
packages/sdk/src/sdk/oauth/tokenStore.ts	Replaces concrete token store class with OAuthTokenStore async interface.
packages/sdk/src/sdk/oauth/tokenStore.test.ts	Updates tests to cover new memory token store behavior.
packages/sdk/src/sdk/oauth/pkce.ts	Reworks PKCE helpers to use noble SHA-256 and adds generateState().
packages/sdk/src/sdk/oauth/index.ts	Updates OAuth exports (no longer re-exporting pkce helpers).
packages/sdk/src/sdk/oauth/TokenStoreMemory.ts	Adds in-memory token store implementation.
packages/sdk/src/sdk/oauth/TokenStoreLocalStorage.ts	Adds localStorage-backed token store implementation.
packages/sdk/src/sdk/oauth/TokenStoreAsyncStorage.ts	Adds AsyncStorage-backed token store for React Native.
packages/sdk/src/sdk/oauth/OAuth.ts	Major OAuth rewrite: async login(), handleRedirect(), token exchange + refresh + logout.
packages/sdk/src/sdk/oauth/OAuth.test.ts	Expands/updates tests for new OAuth behavior and API surface.
packages/sdk/src/sdk/middleware/addTokenRefreshMiddleware.ts	Updates refresh middleware to await async hasRefreshToken().
packages/sdk/src/sdk/middleware/addTokenRefreshMiddleware.test.ts	Updates middleware tests for async hasRefreshToken().
packages/sdk/src/sdk/index.ts	SDK entry exports updated; sdk alias export removed here.
packages/sdk/src/sdk/createSdkWithServices.ts	Updates service initialization + token store wiring; OAuth is always constructed.
packages/sdk/src/sdk/createSdk.ts	Wires redirectUri/openUrl into OAuth; uses async token store for Configuration.accessToken.
packages/sdk/src/index.ts	Adds top-level sdk alias export (sdk = createSdk).
packages/sdk/src/index.native.ts	Adds React Native entrypoint with default AsyncStorage + expo-web-browser login handling.
packages/sdk/rollup.config.ts	Updates React Native build input to src/index.native.ts.
packages/sdk/package.json	Adds RN peer deps (async-storage, expo-web-browser) and dev dep for building.
packages/protocol-dashboard/package.json	Pins @audius/sdk and updates legacy SDK version.
packages/distro/src/components/DistributorCard.tsx	Removes deprecated oauth.init() usage.
package-lock.json	Locks new dependencies/versions for updated packages.
docs/docs/pages/sdk/oauth.mdx	Rewrites OAuth documentation for PKCE + web/mobile flows + new APIs.
.changeset/tricky-zoos-film.md	Removes obsolete changeset.
.changeset/angry-knives-fold.md	Removes obsolete changeset.
.changeset/oauth-pkce-breaking-changes.md	Adds major-version changeset documenting breaking changes and migration guide.

Comments suppressed due to low confidence (1)

packages/sdk/src/sdk/index.ts:7

• sdk is no longer exported from this entrypoint, but the Rollup browser builds use src/sdk/index.ts as their input (sdkBrowserConfigCjs / sdkBrowserConfigEs in packages/sdk/rollup.config.ts). That means browser consumers importing { sdk } from @audius/sdk will lose the alias in browser bundles even though src/index.ts reintroduces it. Consider re-exporting sdk from here (e.g. export { createSdk as sdk }) or switching the browser build inputs to src/index.ts so the alias is consistently available across environments.

/* eslint-disable import/export */
export { createSdk } from './createSdk'
export {
  createSdkWithServices,
  type AudiusSdkWithServices
} from './createSdkWithServices'
export type { AudiusSdk } from './sdk'

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[raymondjacobson]

can/should these be pinned?

[rickyrombo]

no idts, that's too restrictive for peer deps imo