Expand description
OAuth authorization-server discovery from installed issuer and provider policy.
Structs§
- CreateO
Auth Client Input - Metadata accepted when an authenticated owner registers a managed client.
- OAuth
Authenticated Client - A client authenticated for a trusted server operation.
- OAuth
Client Assertion Input - OAuth
Client Authentication Options - Caller policy for the
authenticateClientserver capability. - OAuth
Client Metadata - OAuth metadata supplied by the first-party document validator, not a discovery callback.
- OAuth
Client Metadata Abort Signal - Cancellation exposed to an application-owned client metadata transport.
- OAuth
Client Metadata Fetch Options - Actual options supplied to a configured metadata resource fetch callback.
- OAuth
Client Metadata Fetch Response - A streaming HTTP response and its redirect history, matching a fetch Response.
- OAuth
Client Privilege Context - Actual authenticated context passed to an operator client-privilege decision. The pinned hook receives no client or reference identifier.
- OAuth
Client Registration Result - Durable registration result, rather than an HTTP registration response.
- OAuth
Consent Reference Context - Consent authority selection after post-login interaction. No request headers or client are supplied by the pinned callback contract.
- OAuth
Decoded Refresh Token - Decoded storage preimage. In 1.7.7 consumers use the persisted session binding, not this optional callback-supplied session ID.
- OAuth
Extension Claims - OAuth
Extension Client Authentication - OAuth
Extension Grant Input - OAuth
Initial Access Token Authorization - Admission independent of a user session. An optional application reference owns the client.
- OAuth
Initial Access Token Input - The actual credential, caller headers and parsed registration request, before defaults.
- OAuth
Interaction Context - Authenticated post-login policy input. The pinned callback does not receive a client argument; admission has already validated the requesting client.
- OAuth
Metadata Extension Input - OAuth
Post Login Config - Application interaction after signup policy and before consent.
- OAuth
Provider Config - Immutable policy shared by authorization-server metadata and grant admission.
- OAuth
Provider Extension - One configured extension. Dispatched URI keys must be disjoint across extensions.
- OAuth
Provider Plugin - OAuth
Provider Rate Limits - OAuth protocol endpoint policies, in seconds and requests per client/path. Rules are effective only when application rate limiting is enabled; its storage and ordered custom rules remain authoritative.
- OAuth
Request UriInput - The original request URI and URL-supplied client identity, before schema parsing.
- OAuth
Resource Privilege Context - Authenticated operator input for resource catalog and client-resource link management.
- OAuth
Select Account Config - OAuth
Signup Config - OAuth
Token Claims Input - OAuth
Token Issue Params - Inputs authorized by a trusted grant handler or companion endpoint. Supplying these does not repeat client authentication or scope admission.
- OAuth
User Info Claims Input - OAuth
Verified Client Assertion - Register
Client Metadata Document Input - RegisterO
Auth Client Input - Dynamic registration metadata. Requested resources admit additions to server defaults; unlike scopes, they narrow which optional resource capabilities become durable links.
Enums§
- OAuth
Endpoint Rate Limit - A provider rule can inherit its endpoint default, replace it, or be omitted.
Disabledomits only the plugin rule: global/application policy still applies. - OAuth
Initial Access Token Error - Explicit endpoint failures retain their status, body and headers. Ordinary application failures are deliberately hidden behind the registration endpoint’s OAuth server error.
- OAuth
Metadata Type - OAuth
Refresh Token Encryption - A synchronous value or an asynchronous encryption callback result.
- OAuth
Resource Seed Mode - Restart policy for configured resource rows. The pinned replacement mode is
overwrite. - OAuth
Signup Redirect - Better Auth’s boolean-or-string signup decision. An empty page string, like
false, continues authorization;trueuses the configured page fallback.
Traits§
- OAuth
Client Authentication Strategy - OAuth
Client Discovery - A stable external source of OAuth clients, matching a contributed TS
ClientDiscovery. - OAuth
Client IdGenerator - Application-owned client identifiers. Empty output is preserved, matching the reference.
- OAuth
Client Metadata Resource Fetch - Application-owned network boundary for a discovered client’s referenced resources.
- OAuth
Client Privileges - OAuth
Client Secret Cipher - Custom reversible client-secret storage, matching
storeClientSecret.encryptanddecrypt. - OAuth
Client Secret Generator - Application-owned client credential generation. Empty output uses the default generator.
- OAuth
Client Secret Hasher - Custom client-secret hash storage, matching
storeClientSecret.hashand optionalverify. - OAuth
Consent Reference - OAuth
Extension Grant Handler - A trusted companion owns grant-specific admission; no client is fabricated or pre-authorized.
- OAuth
Initial Access Token Validator - Application-owned async initial-access-token policy.
Nonerejects the credential. - OAuth
Metadata Contributor - OAuth
Post Login Policy - OAuth
Provider Api - Live provider capabilities bound to the actual call and its optional grant.
- OAuth
Redirect UriValidator - Application redirect trust decision. URI safety remains provider-owned.
- OAuth
Refresh Token Formatter - Better Auth’s
formatRefreshToken. Both callbacks are required by its types; absence of the whole formatter preserves raw refresh credentials. - OAuth
Request UriResolver - Application-owned asynchronous authorization request lookup.
- OAuth
Resource Identifier Validator - Application identifier validation replaces the default absolute-URI/fragment check.
- OAuth
Resource Privileges - OAuth
Select Account Policy - Additional account selection on initial authorization only, after authentication.
- OAuth
Signup Policy - OAuth
Token Claims Contributor - OAuth
Token Generator - Application-owned opaque access/refresh credentials. The admitted issuance params provide native context without additional user or client lookups. Empty output is preserved; only an absent configured generator uses randomness.
- OAuth
Token Hasher - Custom opaque-token storage matching Better Auth’s
storeTokens.hashcallback.kindidentifies the token domain; trusted callers may also supply application kinds. - OAuth
User Info Claims Contributor
Functions§
- consume_
client_ assertion - Check assertion hygiene and atomically consume its durable replay identifier.
Type Aliases§
- OAuth
Authorization Query - Authorization parameters with JavaScript-compatible extension values.
- OAuth
Post Login Context - OAuth
Select Account Context - OAuth
Signup Context - Authenticated input to the application’s additional registration decision. Headers come from the physical authorization request, not logical API headers.