Sergio Xalambri
banner
sergiodxa.com
Sergio Xalambri
@sergiodxa.com
Writing "React Router OAuth2 Handbook"

Web Developer at Daffy.org
Blogger at sergiodxa.com
Open Source Author at GitHub.com/sergiodxa
Sponsor me at https://github.com/sponsors/sergiodxa
The code is here if you figure know more about Legend State and can figure out how to do that

github.com/sergiodxa/re...
remix-v3-examples/app/state-libs/legend-state.tsx at main · sergiodxa/remix-v3-examples
Contribute to sergiodxa/remix-v3-examples development by creating an account on GitHub.
github.com
October 17, 2025 at 5:49 AM
Here you have, I tried to use the `observe` function but I was not sure how to stop observing the observable once the component is unmounted (the signal does that), the observable onChange works perfectly for this
October 17, 2025 at 5:48 AM
Want to dive deeper into how tokens work in OAuth2 + OIDC?

Learn how to use them correctly in your Remix or React Router app.

📘 Join the waitlist for the React Router OAuth2 Handbook:
👉 go.sergiodxa.com/x4HNprT
React Router OAuth2 Handbook
Implement secure OAuth2 authentication in React Router and Remix apps with practical patterns.
books.sergiodxa.com
April 16, 2025 at 2:29 AM
🪪 The ID Token’s audience is the Client Application.

It contains user identity info and is meant to be consumed by the client, not by the API or auth server. That’s why its aud claim matches the client’s ID.
April 16, 2025 at 2:29 AM
🔄 The Refresh Token’s audience is the Authorization Server.

It’s the only one allowed to accept it and issue a new Access Token. This keeps refresh logic centralized and secure, preventing misuse by clients or other services.
April 16, 2025 at 2:29 AM
🔑 The Access Token's audience is the Resource Server.

It’s the one that will validate and accept the token to give access to protected resources. This way, only the Resource Server can rely on it—it’s not meant for the client or the auth server.
April 16, 2025 at 2:29 AM
ClientLoader doesn’t have access to context, this is a server only thing, rossipedia has been asking for an equivalent client version for a long time

Client side you can define it once in a separate file and just import it
December 8, 2024 at 3:19 PM
I think @kentcdodds.com build it, he should have the code
December 6, 2024 at 6:44 PM
On the Remix server we have a bot that can create threads when you add a emoji to a message and automatically name the thread like "🧵 Thread for Dominik"

I use it a lot there to create them so I don’t think about the name
December 6, 2024 at 1:00 PM
Most of that was already available before the standalone app, although the app is great, would be nice to have secure notes for things like API keys
November 23, 2024 at 5:17 PM
Yes, you can create a group and share passwords there, you can have many groups too
November 23, 2024 at 5:16 PM
Does this works with providers like GitHub, Google, Auth0, etc? From what I saw it seems it should since they use client id and client secrets?
November 23, 2024 at 10:04 AM
I like the ideas it brings, specially ship less JS, but I'm not convinced the complexity is worth it, although I never tried it since I haven't used Next.js in years

I also don't like how it was approached, I always liked that React features were first tested at Meta with their scale, but not RSC
November 22, 2024 at 12:54 AM
So you can, without Vite 6, already use the actual wrangler instead of the proxy?
November 20, 2024 at 3:18 AM
I have my own starter github.com/edgefirst-de..., alt ought it does more than just a base point
GitHub - edgefirst-dev/starter-worker
Contribute to edgefirst-dev/starter-worker development by creating an account on GitHub.
github.com
November 20, 2024 at 2:40 AM