feat(site): Add OAuth support for Mux

[daniel-hayes]

Summary

Implements OAuth 2.0 authentication with Mux, using a token-based authentication flow with automatic token refresh and session management.

Security Features

• CSRF Protection - State parameter validation in OAuth callback
• Token Encryption - Session cookies encrypted via iron-session
• JWT Verification - All tokens verified against JWKS endpoint
• Secure Cookies - httpOnly, secure (in production)
• Inactivity Timeout - Sessions expire after 5 minutes of inactivity (we can adjust this)

Session Management

• JWT verification for access and ID tokens
• Automatic token refresh when approaching expiration

I decided to use iron-session for encrypting / decrypting cookies on requests. Because of this, you will need to include a secure SESSION_COOKIE_PASSWORD that is at least 32 characters long. Their docs suggest creating one here.

You will need the following .env variables to get the flow working end to end.

# OAuth Configuration
OAUTH_CLIENT_ID=<client-id>
OAUTH_CLIENT_SECRET=<client-secret>
OAUTH_REDIRECT_URI=https://videojs.com/api/auth/callback
OAUTH_URL=<mux oauth url>

# Session Encryption
SESSION_COOKIE_PASSWORD=<32-byte-key>

# Mux API
MUX_API_URL=https://api.mux.com

Check out the Login file to see how we can access this information on the front-end.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Review	Updated (UTC)
vjs-10-demo-html	Ready	Preview, Comment	Dec 23, 2025 11:03pm
vjs-10-demo-next	Ready	Preview, Comment	Dec 23, 2025 11:03pm
vjs-10-demo-react	Ready	Preview, Comment	Dec 23, 2025 11:03pm
vjs-10-website	Ready	Preview, Comment	Dec 23, 2025 11:03pm
vjs-10-website (staging)	Ready	Preview, Comment	Dec 23, 2025 11:03pm

[daniel-hayes]

This file, as well as the Login.astro file are meant to be examples - please feel free to update/delete any and all of this code.