It's helpful if you want your website/webapp to support login with X (Google, Facebook, etc). Your services on the same domain can than use these credentials and eventually use the respective API's with the per-user key.

All you need to do is: a) get key/secret for the respective service b) deploy this microservice with the respective env variables

This kind of explanation would be really useful on the website. Right now it has nothing to describe what it is/does.

The explanation you replied to didn't say anything I didn't find obvious from the tag line.

Aha. So it protects the service via protecting the domain itself, right?

I'll have to give it a try.

"On successful login two cookies will be created:

    jwt - A "JSON Web Token" (JWT) containing profile information and the respective access tokens (Twitter/etc). http-only!
    profile - A JSON string which containing non-sensitive information (accessible from browser JS):
        username - string / mandatory, the account specific user alias (e.g. Twitter name)  - photo - string / optional, the account specific user image link
        name - string / optional, the "real" name

" This looks like just enough rope to hang oneself. If you check only the profile variable it could easily be set by the user herself. So I guess you need to check the jwt. I guess it makes more sense if this would be run as reverse proxy so the cookies can't be tampered with.

The JWT is signed (see LW_JWT_SECRET env variable), you'll want to check the signature before trusting the rest of the contents.

Pet gripe: don't say "JWT tokens", it's just "JWT". That's what the T stands for..

True. It's a bad habit I guess.