Skip to main content Module oauth Copy item path Source encryption Versioned XChaCha20-Poly1305 persistence encryption for OAuth tokens. AppleOptions Apple-specific immutable configuration. Generic provider policy and trusted
application callback overrides remain available on the returned provider. AtlassianOptions Atlassian-specific configuration; callback and persistence policies remain
configurable on the returned OAuth provider. CloudflareOptions Cloudflare configuration. Generic callback/signup policies remain available
on the returned provider. CognitoOptions Immutable Cognito settings. Application callback and signup policies remain
configurable on the returned provider. DropboxOptions Application-owned Dropbox configuration. Generic signup and asynchronous
user-info/refresh callbacks remain configurable on the returned provider. FacebookOptions Application-owned Facebook configuration. User-info/refresh callbacks and
signup policies remain configurable on the returned provider. FigmaOptions Application-owned Figma configuration. Generic signup and asynchronous
user-info/refresh callbacks remain configurable on the returned provider. GenericOAuthConfig Discovery is an operator-configured authority, never a request-selected URL.
Resolve once before registering the provider with OAuthPlugin, or register
the configuration with OAuthPlugin::add_generic_provider to retry discovery
that fails at startup. GenericOAuthMetadata Metadata retained independently from the chosen endpoint overrides. GenericOAuthResolved HttpOAuthJwksSource HTTP transport for an application-configured provider key authority. HuggingFaceOptions Application-owned HuggingFace configuration. Generic signup and asynchronous
user-info/refresh callbacks remain configurable on the returned provider. KakaoOptions Application-owned Kakao configuration. Generic signup and asynchronous
user-info/refresh callbacks remain configurable on the returned provider. KickOptions Application-owned Kick configuration. Generic signup and asynchronous
user-info/refresh callbacks remain configurable on the returned provider. LineOptions Application-owned Line configuration. Generic signup and asynchronous
user-info/refresh callbacks remain configurable on the returned provider. LinearOptions Application-owned Linear configuration. Generic signup and asynchronous
user-info/refresh callbacks remain configurable on the returned provider. LinkedInOptions Application-owned LinkedIn configuration. Generic signup and asynchronous
user-info/refresh callbacks remain configurable on the returned provider. MicrosoftOptions Immutable application configuration for the published Microsoft factory. NaverOptions Application-owned Naver configuration. Generic signup and asynchronous
user-info/refresh callbacks remain configurable on the returned provider. NotionOptions Application-owned Notion configuration. Generic signup and asynchronous
user-info/refresh callbacks remain configurable on the returned provider. OAuthAccessToken Public result of the getAccessToken server operation. OAuthAccountApi Trusted direct account operations. The caller supplies the authorized user;
these methods are not HTTP routes. HTTP handlers always resolve the session
first, and cannot select a principal with a userId body/query field. OAuthAccountIdentity Owned account identity returned by the accountInfo server operation. OAuthAccountKey OAuthAccountKeyContext Raw provider profile and actual grant tokens for application account authority. OAuthAccountProfile Provider profile and owned account returned by the accountInfo server operation. OAuthAuthorizationCodeCallback OAuthAuthorizationCodeContext OAuthAuthorizationPolicy Immutable authorization configuration used by the built-in social providers.
Scope entries retain their original order and whitespace; providers may
opt into removing exact duplicates. OAuthCallbackInput Validated input shared by the OAuth callback’s logical query and POST body. OAuthCallbackUserName OAuthCallbackUserPayload OAuthClientAssertion Cloneable application callback whose Debug output never prints credentials. OAuthClientAssertionContext OAuthConfig Configuration for the OAuth plugin, containing all registered providers. OAuthEndSessionConfig Trusted OIDC logout endpoint and optional default return URI. OAuthIdTokenConfig Trusted provider policy. An explicit audience overrides provider client IDs. OAuthIdTokenRequest ID-token credentials accepted by logical social sign-in. OAuthLinkSocialRequest Public input to the linkSocialAccount server operation. OAuthPlugin OAuthPrivateKeyJwtOptions Key material stays private; Debug deliberately never renders it.
JWK takes precedence over PKCS#8 PEM. Algorithm defaults to JWK alg, then
RS256; explicit algorithm and JWK alg must agree. kid overrides JWK kid. OAuthProvider Configuration for a single OAuth provider. OAuthRefreshContext Metadata of the request triggering an OAuth token refresh.
Headers, cookies and body fields are untrusted. Applications must validate
tenant/scope/audience entitlements before forwarding derived values. OAuthRefreshResult Public result of the refreshToken server operation.
Provider-defined token scalars are preserved in the decoded result. OAuthRefreshTokenParams OAuthSocialSignInRequest Public input to the signInSocial server operation. OAuthSocialSignInResponse Provider authorization URL or authenticated user returned by social sign-in. OAuthTokenSet A provider grant, and the typed result of OAuthAccountApi OAuthUserInfo User information extracted from an OAuth provider’s user info endpoint. OAuthUserInfoRequest OAuthUserInfoResponse PayPalOptions Application-owned PayPal configuration. The published factory ignores scopes,
requestShippingAddress, clientKey and responseMode.
Generic signup and asynchronous callbacks remain available on the provider. PaybinOptions Application-owned Paybin configuration. Generic signup and asynchronous
user-info/refresh callbacks remain configurable on the returned provider. PolarOptions Application-owned Polar configuration. Generic signup and asynchronous
user-info/refresh callbacks remain configurable on the returned provider. RailwayOptions Application-owned Railway configuration. Generic signup and asynchronous
user-info/refresh callbacks remain configurable on the returned provider. RedditOptions Application-owned Reddit configuration. Signup policies and asynchronous
user-info/refresh overrides remain available on the returned native provider. RobloxOptions SalesforceOptions SlackOptions SpotifyOptions TikTokOptions TwitchOptions TwitterOptions VercelOptions VkOptions WeChatOptions ZoomOptions DropboxAccessType Dropbox’s declared token access modes. GenericOAuthError Configuration failures contain no operator endpoints or transport errors. MicrosoftProfilePhotoSize Supported Graph profile-photo sizes in pixels. OAuthAccountSelection OAuthJwksSelection OAuthNonceComparison OAuthScopeEncoding Encoding of the scope query value required by a provider’s authorization endpoint. OAuthScopeOrder Ordering of configured and per-request additions to a provider’s base scopes. OAuthTokenEndpointAuth OAuth token-endpoint credential transport selected by a provider. OAuthTokenGrant The actual token grant for an application’s asynchronous client assertion. PayPalEnvironment SalesforceEnvironment WeChatLanguage OAuthAccountKeyResolver OAuthAuthorizationCodeHandler OAuthClientAssertionGetter Produces a fresh application credential for the actual bound token request. OAuthIdTokenClaimsVerifier Application-owned policy applied to claims only after cryptographic and
standard claim verification. It must not select an untrusted key authority. OAuthIdTokenVerifier OAuthJwksSource Application-owned key transport/cache. Request claims never choose its URL. OAuthProfileMapper Asynchronous partial application mapping of the original provider profile.
Absent keys retain published defaults; raw output remains independent from
typed persistence, and returned IDs never replace original account authority. OAuthRefreshTokenHandler OAuthRefreshTokenParamsResolver An asynchronous alternative to static refreshTokenParams. OAuthUserInfoHandler oauth_callback_path oauth_disable_sign_up_option resolve_oauth_account_key OAuthAccountSubject Resolve a provider’s stable account identity from its original profile.