atproto-oauth-axum

Axum web handlers for AT Protocol OAuth 2.0 authorization server endpoints.

Overview

atproto-oauth-axum provides ready-to-use Axum web handlers that implement the complete AT Protocol OAuth 2.0 authorization server specification. This library handles OAuth client metadata discovery, JWKS endpoints, authorization callback processing, and includes a command-line OAuth login tool.

Binaries

atproto-oauth-tool: Complete OAuth login CLI tool for AT Protocol services

Features

Complete OAuth server handlers for Axum web applications
Client metadata endpoint with RFC 7591 compliance
JWKS endpoint for JSON Web Key Set serving
Authorization callback handler with token exchange
Native Axum state management and request extractors
AT Protocol compliance validation

Usage

Basic Server Setup

use atproto_oauth_axum::{
    handle_complete::handle_oauth_callback,
    handle_jwks::handle_oauth_jwks,
    handler_metadata::handle_oauth_metadata,
    state::OAuthClientConfig,
};
use axum::{routing::get, Router};

let oauth_config = OAuthClientConfig {
    client_uri: "https://your-app.com".to_string(),
    client_id: "https://your-app.com/oauth/client-metadata.json".to_string(),
    redirect_uris: "https://your-app.com/oauth/callback".to_string(),
    jwks_uri: "https://your-app.com/.well-known/jwks.json".to_string(),
    signing_keys: vec![identify_key("did:key:zQ3sh...")?],
};

let app = Router::new()
    .route("/oauth/client-metadata.json", get(handle_oauth_metadata))
    .route("/.well-known/jwks.json", get(handle_oauth_jwks))
    .route("/oauth/callback", get(handle_oauth_callback))
    .with_state(oauth_config);

OAuth Handlers

The library provides ready-to-use handlers for:

Client Metadata: Generates RFC 7591 compliant metadata
JWKS Endpoint: Serves JSON Web Key Sets for signature verification
Callback Processing: Handles OAuth authorization callbacks with token exchange

Command Line Examples

# Start OAuth login flow for a handle
cargo run --bin atproto-oauth-tool login did:key:zQ3sh... alice.bsky.social

# Start OAuth login flow for a DID
cargo run --bin atproto-oauth-tool login did:key:zQ3sh... did:plc:user123

The tool provides a complete OAuth client implementation with:

Subject resolution and DID document retrieval
PDS and authorization server discovery
PKCE and DPoP parameter generation
Local web server for callback handling
Complete token exchange flow

License

MIT License

atproto-oauth-axum 0.9.3