Hi @JMK, thank you for providing your code. You should be able to solve your problem by moving app.use(oidc.router); above your other route definitions. The OIDC router sets up all the middleware that is needed to later use oidc.ensureAuthenticated(). We will update our documentation to make this clearer.
I also see that you have a call to oidc.ensureAuthenticated() inside of your protected route handler, that should be removed.