Plugins
Official okengine/plugins extensions — authentication, OAuth, security, operations, and performance.
First-party plugins you .plug() onto an app. Each page is one export from okengine/plugins.
Authentication
Username
Username + password.
Anonymous
Guest session, no password.
Magic link
One-time email link.
OTP
SMS, WhatsApp, or email codes.
Two-factor
TOTP enable / verify.
Passkey
WebAuthn-shaped passkeys.
OAuth
OAuth
Social sign-in — Authorization Code + PKCE for eight providers.
Apple
Sign in with Apple — form_post + ES256 JWT.
Discord
Discord OAuth2 with nullable email.
Facebook Login — never-verified emails.
Figma
Figma OAuth2 with HTTP Basic token auth.
GitHub
GitHub OAuth2 with verified-email lookup.
Google OIDC — JWKS-verified ID tokens.
Microsoft
Entra ID OIDC with tenant-aware issuer checks.
X
X OAuth2 public client — PKCE only.
Security
Headers
Secure headers on every HTTP response.
CORS
Cross-origin rules; closed by default.
CSRF
Fetch-metadata forgery defense, no tokens.
IP Allowlist
Allow/deny by client IP at the edge.