I have a Node.js server using PassportJS that uses social login via Google, Facebook, and Twitter.

The Node.js server hosts an API that uses the PassportJS middleware to authenticate routes and securely serve the data. The API exists to serve an iOS application which will be where the user "logs in" through Google, Facebook, Twitter and will subsequently create their account on my service.

How can I accomplish this when the mobile SDKs for the respective companies are for a direct communication between my client and their server? I essentially want a way for my client which talks to my server which talks to their server. Please let me know if the overall idea is incorrect as well.

1 Answer 1


Wouldn't those processes happen one after another? Here's a workflow that makes sense to me as a user:

  1. I log into your web service using my Facebook account. This provides you with my e-mail address and Facebook user ID.
  2. Your web service then asks me to authorize you to use a mobile API using (say) Pocket. Usually, this involves sending me to a URL on http://getpocket.com which will ask me to confirm that I want your web service to have certain permissions to my Pocket account. Once I've confirmed, it redirects me back to your webservice, passing it an access token that your webservice can then use to access my account. You can then store this token either locally on my client or on my server, in both cases making sure that I need to log into your service before your service can use my access token to access a mobile API using my credentials.
  3. Your webservice can now make API requests against Pocket using my access token, until I revoke your access from my Pocket account.

If the mobile API you want to use provides authentication (as Pocket does), you might be able to authenticate and obtain permission at the same time. I've never used PassportJS, but it looks like the scope option allows you to ask for permissions while logging in through a particular service; if you do this, I assume that the user profile object you obtain will contain an access token you can use to make further Facebook requests.

Whether this access token is stored in your client or your server shouldn't make any difference, as long as it is passed to their server when you make API requests on behalf of your user.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.