---
title: "Libraries"
canonical: "https://docs.pbs.org/space/PMSSO/29229084/Libraries"
format: markdown
---
> Macro (toc)

## OpenID Connect Libraries 

The following is a list of recommended languages and platforms to leverage when integrating Hosted Login. Select one that corresponds to your site or application and you’ll be taken directly to the third-party library or service. 

If you do not see an option that works for you here, visit OpenID’s full list of [certified](https://openid.net/developers/certified/) and [uncertified](https://openid.net/developers/uncertified/) OIDC implementations. 

- [Angular](https://github.com/damienbod/angular-auth-oidc-client)
- *[AppAuth for Android](https://github.com/openid/AppAuth-Android)
- *[AppAuth for iOS](https://github.com/openid/AppAuth-iOS)
- Drupal: [OpenID Connect / OAuth client](https://www.drupal.org/project/openid_connect)
- [JavaScript](https://github.com/IdentityModel/oidc-client-js)
- Node.js: [passport-openidconnect](https://www.passportjs.org/packages/passport-openidconnect/)
- React: [react-oidc](https://www.npmjs.com/package/react-oidc)
- Salesforce: [https://help.salesforce.com/s/articleView?id=sf.sso_provider_openid_connect.htm&type=5](https://help.salesforce.com/s/articleView?id=sf.sso_provider_openid_connect.htm&type=5)
- [Vue](https://github.com/soukoku/vue-oidc-client)
- Wordpress: [WordPress OpenID Connect Client](https://wordpress.org/plugins/miniorange-openid-connect-client/)

**Mobile applications have some additional considerations and should follow the best practices for “native apps” outlined in *<u>*[RFC 8252](https://tools.ietf.org/html/rfc8252)*</u>*. *

### Mobile app requirements

Mobile apps must: 

- Use the system browser and not a webview. Both iOS and Android offer special app features to make this experience seamless for the end user:
  - iOS - <u>[ASWebAuthenticationSession](https://developer.apple.com/documentation/authenticationservices/aswebauthenticationsession)</u>
  - Android - <u>[Chrome Custom Tabs](https://developer.chrome.com/multidevice/android/customtabs)</u>
- Set up a redirection scheme for the app’s redirect_uri using either:
  - A custom mobile redirect_uri (e.g. **com.example.app://oauth2redirect/example-provider**).
  - A claimed HTTPS redirect URI. Android and iOS offer support for this feature via the following:
    - <u>[iOS Universal Links](https://developer.apple.com/ios/universal-links/)</u>
    - <u>[Android App Links](https://developer.android.com/training/app-links)</u>
- Use Proof Key for Code Exchange (PKCE) - <u>[RFC 7636](https://tools.ietf.org/html/rfc7636)</u>:
  - The Identity Cloud requires public clients to use PKCE.
  - With PKCE, public clients generate a one-time secret for the transaction and send a hashed version with the /authorize request. When calling the /token endpoint public clients authenticate by sending this secret.

Google has published open-source libraries for mobile apps (AppAuth) that demonstrate how to implement the preceding requirements for mobile apps. These libraries are maintained by the OpenID Foundation and implement the best practices outlined in <u>[RFC 8252](https://tools.ietf.org/html/rfc8252)</u>:

- <u>[AppAuth iOS](https://github.com/openid/AppAuth-iOS)</u>
- <u>[AppAuth Android](https://github.com/openid/AppAuth-Android)</u>

## Grove

- View the NPR [guide to getting started with SSO](https://studio.npr.org/s/article?name=Guide-to-getting-started-with-Single-Sign-On-SSO) (NPR Studio Login Required)

## Bento

Stations can implement SSO on the PBS website builder tool, [Bento](https://docs.pbs.org/space/B3/4751362/Bento+3.0), to eliminate the need for users to create separate accounts when moving between NPR, PBS, participating NPR & PBS stations, and third-party content providers. Bento users can visit their local station website, the NPR One app, and the PBS Video app, while using the same username and password.

Before implementing SSO on your Bento site, first complete the following: 

- Fill out and submit the Public Media SSO <u>[interest form.](https://www.surveymonkey.com/r/publicmediasso)</u>
  - This form provides PBS with the necessary information to onboard your station and launch SSO on your website.
- Participate in an [onboarding cohort](https://hub.pbs.org/spi/spi-initiatives/public-media-sso) set up by PBS.
  - After filling out the interest form, PBS will contact you to schedule this.

The process of implementing SSO on Bento sites is being performed on a rolling basis throughout 2024. 

**To implement SSO in Bento, please review the ****[Bento documentation](https://docs.pbs.org/space/B3/4751514/Station+Header#How-to-implement-Public-Media-Single-Sign-On-(SSO))****.**