Enum Credential 

pub enum Credential {
    Password {
        username: String,
        password: String,
    },
    OAuth {
        authorization_code: String,
        redirect_uri: Option<String>,
        code_verifier: Option<String>,
        state: Option<String>,
    },
    OAuthRefresh {
        refresh_token: String,
    },
    ApiKey {
        key: String,
    },
    Jwt {
        token: String,
    },
    Bearer {
        token: String,
    },
    Basic {
        credentials: String,
    },
    Custom {
        method: String,
        data: HashMap<String, String>,
    },
    Mfa {
        primary_credential: Box<Credential>,
        mfa_code: String,
        challenge_id: String,
    },
    Certificate {
        certificate: Vec<u8>,
        private_key: Vec<u8>,
        passphrase: Option<String>,
    },
    OpenIdConnect {
        id_token: String,
        access_token: Option<String>,
        refresh_token: Option<String>,
    },
    DeviceCode {
        device_code: String,
        client_id: String,
        user_code: Option<String>,
        verification_uri: Option<String>,
        verification_uri_complete: Option<String>,
        expires_in: Option<u64>,
        interval: Option<u64>,
    },
    EnhancedDeviceFlow {
        device_code: String,
        user_code: String,
        verification_uri: String,
        verification_uri_complete: Option<String>,
        expires_in: u64,
        interval: u64,
        client_id: String,
        client_secret: Option<String>,
        scopes: Vec<String>,
    },
}

Represents different types of credentials that can be used for authentication.

Variants

Password

Username and password credentials

Fields

username: String

password: String

OAuth

OAuth authorization code flow

Fields

authorization_code: String

redirect_uri: Option<String>

code_verifier: Option<String>

state: Option<String>

OAuthRefresh

OAuth refresh token

Fields

refresh_token: String

ApiKey

API key authentication

Fields

key: String

Jwt

JSON Web Token

Fields

token: String

Bearer

Bearer token (generic)

Fields

token: String

Basic

Basic authentication (username:password base64 encoded)

Fields

credentials: String

Custom

Custom authentication with flexible key-value pairs

Fields

method: String

data: HashMap<String, String>

Mfa

Multi-factor authentication token

Fields

primary_credential: Box<Credential>

mfa_code: String

challenge_id: String

Certificate

Certificate-based authentication

Fields

certificate: Vec<u8>

private_key: Vec<u8>

passphrase: Option<String>

OpenIdConnect

OpenID Connect ID token

Fields

id_token: String

access_token: Option<String>

refresh_token: Option<String>

DeviceCode

Device flow credentials (device code polling)

Fields

device_code: String

client_id: String

user_code: Option<String>

verification_uri: Option<String>

verification_uri_complete: Option<String>

expires_in: Option<u64>

interval: Option<u64>

EnhancedDeviceFlow

Enhanced device flow credentials with full OAuth device flow support

Fields

device_code: String

user_code: String

verification_uri: String

verification_uri_complete: Option<String>

expires_in: u64

interval: u64

client_id: String

client_secret: Option<String>

scopes: Vec<String>

Implementations

impl Credential

pub fn password( username: impl Into<String>, password: impl Into<String>, ) -> Self

Create password credentials.

Example

let cred = Credential::password("alice", "s3cret!");
assert_eq!(cred.credential_type(), "password");

pub fn oauth_code(authorization_code: impl Into<String>) -> Self

Create OAuth authorization code credentials.

Start with the authorization code only; attach optional fields like redirect_uri via the OAuth variant’s public fields.

pub fn oauth_code_with_pkce( authorization_code: impl Into<String>, code_verifier: impl Into<String>, ) -> Self

Create OAuth authorization code credentials with PKCE.

Includes a code verifier for the Proof Key for Code Exchange flow.

pub fn oauth_refresh(refresh_token: impl Into<String>) -> Self

Create OAuth refresh token credentials

pub fn device_code( device_code: impl Into<String>, client_id: impl Into<String>, ) -> Self

Create device code credentials for device flow.

Starts a device authorization grant with just the device code and client ID. Optional fields (user_code, verification_uri, etc.) are available on the DeviceCode variant.

pub fn api_key(key: impl Into<String>) -> Self

Create API key credentials

pub fn jwt(token: impl Into<String>) -> Self

Create JWT credentials

pub fn bearer(token: impl Into<String>) -> Self

Create bearer token credentials

pub fn basic(username: impl Into<String>, password: impl Into<String>) -> Self

Create basic authentication credentials

pub fn custom(method: impl Into<String>, data: HashMap<String, String>) -> Self

Create custom credentials with arbitrary key-value data.

The method string identifies the custom auth method, while data carries method-specific fields.

Example

use std::collections::HashMap;

let mut data = HashMap::new();
data.insert("hardware_token".into(), "ABC123".into());
let cred = Credential::custom("hardware", data);

pub fn mfa( primary_credential: Credential, mfa_code: impl Into<String>, challenge_id: impl Into<String>, ) -> Self

Create MFA credentials that wrap a primary credential with a second-factor code and challenge identifier.

pub fn certificate( certificate: Vec<u8>, private_key: Vec<u8>, passphrase: Option<String>, ) -> Self

Create certificate credentials from raw DER-encoded bytes.

For certificates already verified by TLS, consider client_cert_from_tls instead.

pub fn client_cert_from_tls(der_certificate: Vec<u8>) -> Self

Create credentials representing a client certificate that was already verified by the mTLS handshake. The private key is not required — key possession was proved by TLS; supplying one has no effect.

pub fn openid_connect(id_token: impl Into<String>) -> Self

Create SAML assertion credentials - REMOVED for security

Create OpenID Connect credentials

pub fn credential_type(&self) -> &str

Get the credential type as a string

pub fn supports_refresh(&self) -> bool

Check if this credential supports refresh

pub fn refresh_token(&self) -> Option<&str>

Extract refresh token if available

pub fn is_sensitive(&self) -> bool

Check if this credential is sensitive and should be masked in logs

pub fn safe_display(&self) -> String

Get a safe representation for logging (masks sensitive data)

Trait Implementations

impl Clone for Credential

fn clone(&self) -> Credential

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Credential

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for Credential

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for Credential

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.