Module oauth 

Modules

encryption

Versioned XChaCha20-Poly1305 persistence encryption for OAuth tokens.

Structs

AppleOptions

Apple-specific immutable configuration. Generic provider policy and trusted application callback overrides remain available on the returned provider.

AtlassianOptions

Atlassian-specific configuration; callback and persistence policies remain configurable on the returned OAuth provider.

CloudflareOptions

Cloudflare configuration. Generic callback/signup policies remain available on the returned provider.

CognitoOptions

Immutable Cognito settings. Application callback and signup policies remain configurable on the returned provider.

DropboxOptions

Application-owned Dropbox configuration. Generic signup and asynchronous user-info/refresh callbacks remain configurable on the returned provider.

FacebookOptions

Application-owned Facebook configuration. User-info/refresh callbacks and signup policies remain configurable on the returned provider.

FigmaOptions

Application-owned Figma configuration. Generic signup and asynchronous user-info/refresh callbacks remain configurable on the returned provider.

GenericOAuthConfig

Discovery is an operator-configured authority, never a request-selected URL. Resolve once before registering the provider with OAuthPlugin.

GenericOAuthMetadata

Metadata retained independently from the chosen endpoint overrides.

GenericOAuthResolved

HttpOAuthJwksSource

HTTP transport for an application-configured provider key authority.

HuggingFaceOptions

Application-owned HuggingFace configuration. Generic signup and asynchronous user-info/refresh callbacks remain configurable on the returned provider.

KakaoOptions

Application-owned Kakao configuration. Generic signup and asynchronous user-info/refresh callbacks remain configurable on the returned provider.

KickOptions

Application-owned Kick configuration. Generic signup and asynchronous user-info/refresh callbacks remain configurable on the returned provider.

LineOptions

Application-owned Line configuration. Generic signup and asynchronous user-info/refresh callbacks remain configurable on the returned provider.

LinearOptions

Application-owned Linear configuration. Generic signup and asynchronous user-info/refresh callbacks remain configurable on the returned provider.

LinkedInOptions

Application-owned LinkedIn configuration. Generic signup and asynchronous user-info/refresh callbacks remain configurable on the returned provider.

MicrosoftOptions

Immutable application configuration for the published Microsoft factory.

NaverOptions

Application-owned Naver configuration. Generic signup and asynchronous user-info/refresh callbacks remain configurable on the returned provider.

NotionOptions

Application-owned Notion configuration. Generic signup and asynchronous user-info/refresh callbacks remain configurable on the returned provider.

OAuthAccessToken

Public result of the getAccessToken server operation.

OAuthAccountApi

Trusted direct account operations. The caller supplies the authorized user; these methods are not HTTP routes. HTTP handlers always resolve the session first, and cannot select a principal with a userId body/query field.

OAuthAccountIdentity

Owned account identity returned by the accountInfo server operation.

OAuthAccountKey

OAuthAccountKeyContext

Raw provider profile and actual grant tokens for application account authority.

OAuthAccountProfile

Provider profile and owned account returned by the accountInfo server operation.

OAuthAuthorizationCodeCallback

OAuthAuthorizationCodeContext

OAuthAuthorizationPolicy

Immutable authorization configuration used by the built-in social providers. Scope entries retain their original order and whitespace; providers may opt into removing exact duplicates.

OAuthCallbackInput

Validated input shared by the OAuth callback’s logical query and POST body.

OAuthCallbackUserName

OAuthCallbackUserPayload

OAuthClientAssertion

Cloneable application callback whose Debug output never prints credentials.

OAuthClientAssertionContext

OAuthConfig

Configuration for the OAuth plugin, containing all registered providers.

OAuthEndSessionConfig

Trusted OIDC logout endpoint and optional default return URI.

OAuthIdTokenConfig

Trusted provider policy. An explicit audience overrides provider client IDs.

OAuthIdTokenRequest

ID-token credentials accepted by logical social sign-in.

OAuthLinkSocialRequest

Public input to the linkSocialAccount server operation.

OAuthPlugin

OAuthPrivateKeyJwtOptions

Key material stays private; Debug deliberately never renders it. JWK takes precedence over PKCS#8 PEM. Algorithm defaults to JWK alg, then RS256; explicit algorithm and JWK alg must agree. kid overrides JWK kid.

OAuthProvider

Configuration for a single OAuth provider.

OAuthRefreshContext

Metadata of the request triggering an OAuth token refresh. Headers, cookies and body fields are untrusted. Applications must validate tenant/scope/audience entitlements before forwarding derived values.

OAuthRefreshResult

Public result of the refreshToken server operation. Provider-defined token scalars are preserved in the decoded result.

OAuthRefreshTokenParams

OAuthSocialSignInRequest

Public input to the signInSocial server operation.

OAuthSocialSignInResponse

Provider authorization URL or authenticated user returned by social sign-in.

OAuthTokenSet

A provider grant, and the typed result of OAuthAccountApi’s token operations.

OAuthUserInfo

User information extracted from an OAuth provider’s user info endpoint.

OAuthUserInfoRequest

OAuthUserInfoResponse

PayPalOptions

Application-owned PayPal configuration. The published factory ignores scopes, requestShippingAddress, clientKey and responseMode. Generic signup and asynchronous callbacks remain available on the provider.

PaybinOptions

Application-owned Paybin configuration. Generic signup and asynchronous user-info/refresh callbacks remain configurable on the returned provider.

PolarOptions

Application-owned Polar configuration. Generic signup and asynchronous user-info/refresh callbacks remain configurable on the returned provider.

RailwayOptions

Application-owned Railway configuration. Generic signup and asynchronous user-info/refresh callbacks remain configurable on the returned provider.

RedditOptions

Application-owned Reddit configuration. Signup policies and asynchronous user-info/refresh overrides remain available on the returned native provider.

RobloxOptions

SalesforceOptions

SlackOptions

SpotifyOptions

TikTokOptions

TwitchOptions

TwitterOptions

VercelOptions

VkOptions

WeChatOptions

ZoomOptions

Enums

DropboxAccessType

Dropbox’s declared token access modes.

GenericOAuthError

Configuration failures contain no operator endpoints or transport errors.

MicrosoftProfilePhotoSize

Supported Graph profile-photo sizes in pixels.

OAuthAccountSelection

OAuthJwksSelection

OAuthNonceComparison

OAuthScopeEncoding

Encoding of the scope query value required by a provider’s authorization endpoint.

OAuthScopeOrder

Ordering of configured and per-request additions to a provider’s base scopes.

OAuthTokenEndpointAuth

OAuth token-endpoint credential transport selected by a provider.

OAuthTokenGrant

The actual token grant for an application’s asynchronous client assertion.

PayPalEnvironment

SalesforceEnvironment

WeChatLanguage

Traits

OAuthAccountKeyResolver

OAuthAuthorizationCodeHandler

OAuthClientAssertionGetter

Produces a fresh application credential for the actual bound token request.

OAuthIdTokenClaimsVerifier

Application-owned policy applied to claims only after cryptographic and standard claim verification. It must not select an untrusted key authority.

OAuthIdTokenVerifier

OAuthJwksSource

Application-owned key transport/cache. Request claims never choose its URL.

OAuthProfileMapper

Asynchronous partial application mapping of the original provider profile. Absent keys retain published defaults; raw output remains independent from typed persistence, and returned IDs never replace original account authority.

OAuthRefreshTokenHandler

OAuthRefreshTokenParamsResolver

An asynchronous alternative to static refreshTokenParams.

OAuthUserInfoHandler

Functions

oauth_callback_path

oauth_disable_sign_up_option

resolve_oauth_account_key

Type Aliases

OAuthAccountSubject

Resolve a provider’s stable account identity from its original profile.