Struct OAuthProviderConfig 

pub struct OAuthProviderConfig {

    pub rate_limit: OAuthProviderRateLimits,
    pub scopes: Vec<String>,
    pub extensions: Vec<Arc<OAuthProviderExtension>>,
    pub custom_user_info_claims: Option<Arc<dyn OAuthUserInfoClaimsContributor>>,
    pub custom_id_token_claims: Option<Arc<dyn OAuthTokenClaimsContributor>>,
    pub custom_access_token_claims: Option<Arc<dyn OAuthTokenClaimsContributor>>,
    pub custom_token_response_fields: Option<Arc<dyn OAuthTokenClaimsContributor>>,
    pub client_discoveries: Vec<Arc<dyn OAuthClientDiscovery>>,
    pub cached_trusted_clients: HashSet<String>,
    pub client_privileges: Option<Arc<dyn OAuthClientPrivileges>>,
    pub client_credentials_scope_privileges: Option<Arc<dyn OAuthClientPrivileges>>,
    pub client_id_generator: Option<Arc<dyn OAuthClientIdGenerator>>,
    pub client_secret_generator: Option<Arc<dyn OAuthClientSecretGenerator>>,
    pub validate_redirect_uri: Option<Arc<dyn OAuthRedirectUriValidator>>,
    pub request_uri_resolver: Option<Arc<dyn OAuthRequestUriResolver>>,
    pub client_secret_hasher: Option<Arc<dyn OAuthClientSecretHasher>>,
    pub token_hasher: Option<Arc<dyn OAuthTokenHasher>>,
    pub opaque_access_token_generator: Option<Arc<dyn OAuthTokenGenerator>>,
    pub refresh_token_generator: Option<Arc<dyn OAuthTokenGenerator>>,
    pub opaque_access_token_prefix: Option<String>,
    pub refresh_token_prefix: Option<String>,
    pub refresh_token_formatter: Option<Arc<dyn OAuthRefreshTokenFormatter>>,
    pub client_secret_cipher: Option<Arc<dyn OAuthClientSecretCipher>>,
    pub client_secret_prefix: Option<String>,
    pub login_page: String,
    pub consent_page: String,
    pub select_account_page: Option<String>,
    pub select_account: Option<OAuthSelectAccountConfig>,
    pub signup: Option<OAuthSignupConfig>,
    pub post_login: Option<OAuthPostLoginConfig>,
    pub code_expires_in: f64,
    pub access_token_expires_in: f64,
    pub m2m_access_token_expires_in: f64,
    pub id_token_expires_in: f64,
    pub refresh_token_expires_in: f64,
    pub scope_expirations: HashMap<String, JwtExpiration>,
    pub assertion_max_lifetime: f64,
    pub refresh_token_reuse_interval: f64,
    pub allow_public_client_prelogin: bool,
    pub enforce_per_client_resources: bool,
    pub cached_resources: HashSet<String>,
    pub resources: Vec<Value>,
    pub resource_seed_mode: OAuthResourceSeedMode,
    pub identifier_validator: Option<Arc<dyn OAuthResourceIdentifierValidator>>,
    pub resource_privileges: Option<Arc<dyn OAuthResourcePrivileges>>,
    pub advertised_scopes: Option<Vec<String>>,
    pub advertised_claims: Option<Vec<String>>,
    pub grant_types: Vec<String>,
    pub allow_dynamic_client_registration: bool,
    pub client_registration_require_pkce: Option<bool>,
    pub client_registration_default_scopes: Option<Vec<String>>,
    pub client_registration_allowed_scopes: Option<Vec<String>>,
    pub client_registration_default_resources: Option<Vec<String>>,
    pub client_registration_allowed_resources: Option<Vec<String>>,
    pub initial_access_token_validator: Option<Arc<dyn OAuthInitialAccessTokenValidator>>,
    pub allow_unauthenticated_client_registration: bool,
    pub disable_jwt_plugin: bool,
    pub pairwise_secret: Option<String>,
    pub dpop_signing_algorithms: Option<Vec<String>>,
    pub dpop_proof_max_age_seconds: Option<f64>,
}

Immutable policy shared by authorization-server metadata and grant admission.

Fields

rate_limit: OAuthProviderRateLimits

Protocol quotas registered with the global rate limiter, not private API calls.

scopes: Vec<String>

extensions: Vec<Arc<OAuthProviderExtension>>

custom_user_info_claims: Option<Arc<dyn OAuthUserInfoClaimsContributor>>

Operator-owned UserInfo claims, applied after additive extension claims. May override ordinary profile claims, but never the authoritative subject.

custom_id_token_claims: Option<Arc<dyn OAuthTokenClaimsContributor>>

Operator-owned ID-token claims. Profile claims may override additive contributions; provider-owned protocol claims remain authoritative.

custom_access_token_claims: Option<Arc<dyn OAuthTokenClaimsContributor>>

Operator access claims, above per-issuance claims but below resource policy. Opaque validation re-derives them without an issuance grant.

custom_token_response_fields: Option<Arc<dyn OAuthTokenClaimsContributor>>

Application response-envelope fields, collected before token writes. Per-issuance fields take precedence; protocol response fields remain provider-owned.

client_discoveries: Vec<Arc<dyn OAuthClientDiscovery>>

cached_trusted_clients: HashSet<String>

Managed identities cached by provider instance and protected from API mutations.

client_privileges: Option<Arc<dyn OAuthClientPrivileges>>

Global client-management policy, checked before client lookup or mutation. Metadata and secret operations remain owner-controlled. Administrative scopes-only patches additionally require the configure-scopes decision.

client_credentials_scope_privileges: Option<Arc<dyn OAuthClientPrivileges>>

Operator decision for assigning client-credentials scopes. This narrower policy does not authorize other management actions. When both policies are configured, both must allow scope assignment.

client_id_generator: Option<Arc<dyn OAuthClientIdGenerator>>

client_secret_generator: Option<Arc<dyn OAuthClientSecretGenerator>>

validate_redirect_uri: Option<Arc<dyn OAuthRedirectUriValidator>>

Override registered redirect matching after provider-owned URI safety checks.

request_uri_resolver: Option<Arc<dyn OAuthRequestUriResolver>>

Optional request registry; absent by default (request_uri_not_supported).

client_secret_hasher: Option<Arc<dyn OAuthClientSecretHasher>>

token_hasher: Option<Arc<dyn OAuthTokenHasher>>

Application token hashing for authorization codes, access and refresh tokens.

opaque_access_token_generator: Option<Arc<dyn OAuthTokenGenerator>>

refresh_token_generator: Option<Arc<dyn OAuthTokenGenerator>>

opaque_access_token_prefix: Option<String>

Presentation prefix for opaque access credentials; storage hashes plaintext.

refresh_token_prefix: Option<String>

Presentation prefix for refresh credentials; storage hashes plaintext.

refresh_token_formatter: Option<Arc<dyn OAuthRefreshTokenFormatter>>

Application-owned refresh presentation, separate from generation and hashing.

client_secret_cipher: Option<Arc<dyn OAuthClientSecretCipher>>

client_secret_prefix: Option<String>

Wire prefix matching Better Auth’s prefix.clientSecret; stored credentials exclude it.

login_page: String

consent_page: String

select_account_page: Option<String>

select_account: Option<OAuthSelectAccountConfig>

signup: Option<OAuthSignupConfig>

post_login: Option<OAuthPostLoginConfig>

code_expires_in: f64

access_token_expires_in: f64

User access-token lifetime in seconds, including refresh grant issuance.

m2m_access_token_expires_in: f64

Access-token lifetime for issuance without a user.

id_token_expires_in: f64

refresh_token_expires_in: f64

scope_expirations: HashMap<String, JwtExpiration>

Per-scope access-expiration ceilings. Numeric values are absolute Unix seconds (and numeric zero is ignored), matching the reference policy.

assertion_max_lifetime: f64

Maximum assertion future expiration and issued-at age, in seconds (default 300).

refresh_token_reuse_interval: f64

allow_public_client_prelogin: bool

enforce_per_client_resources: bool

cached_resources: HashSet<String>

Opt-in resource-policy cache membership. Entries are process-global by identifier, including across initialized stores, matching the pinned provider. External writes remain live by default; successful admin CRUD evicts entries.

resources: Vec<Value>

Configured resource identifiers or policy objects, using the provider’s camelCase fields.

resource_seed_mode: OAuthResourceSeedMode

identifier_validator: Option<Arc<dyn OAuthResourceIdentifierValidator>>

resource_privileges: Option<Arc<dyn OAuthResourcePrivileges>>

Optional operator decision for resource CRUD and link/unlink actions. Without a hook, any authenticated session with headers may manage resources.

advertised_scopes: Option<Vec<String>>

advertised_claims: Option<Vec<String>>

grant_types: Vec<String>

allow_dynamic_client_registration: bool

client_registration_require_pkce: Option<bool>

Dynamic confidential clients may omit PKCE only when explicitly false. Public and managed clients retain their existing PKCE policy.

client_registration_default_scopes: Option<Vec<String>>

Baseline dynamic-registration capabilities. None uses provider scopes; Some(vec![]) deliberately supplies no baseline capabilities.

client_registration_allowed_scopes: Option<Vec<String>>

Additional dynamic-registration capabilities, unioned after the baseline. Requested registration scopes validate against, but do not narrow, this union.

client_registration_default_resources: Option<Vec<String>>

Server-default resource links for newly registered clients. Omitted and empty lists both supply no links; identifiers must be present in resources.

client_registration_allowed_resources: Option<Vec<String>>

Additional resource identifiers that dynamic registration may explicitly request. Defaults remain admitted even when this list is empty.

initial_access_token_validator: Option<Arc<dyn OAuthInitialAccessTokenValidator>>

Operator authorization for Bearer credentials presented without a genuine user session.

allow_unauthenticated_client_registration: bool

disable_jwt_plugin: bool

pairwise_secret: Option<String>

dpop_signing_algorithms: Option<Vec<String>>

dpop_proof_max_age_seconds: Option<f64>

Trait Implementations

impl Clone for OAuthProviderConfig

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for OAuthProviderConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for OAuthProviderConfig

fn default() -> Self

Returns the “default value” for a type.