klieo-auth-oauth

JWT / JWKS bearer-token verifier for klieo HTTP transports (A2A and MCP server).

Implements the Authenticator trait from klieo-auth-common — plug directly into any klieo HTTP server builder.

Part of the klieo Rust agent framework.

Features

OIDC discovery — fetch JWKS URI and issuer metadata from the provider's .well-known/openid-configuration endpoint automatically.
Static JWKS URI — supply the JWKS endpoint directly when discovery is not needed.
LRU token cache — verified tokens are cached by their JWT ID / signature hash (configurable capacity) to avoid re-verifying the same token on every request.
Required audience validation — .audience() is required since 0.37; omitting it returns Err(OAuthError::Misconfigured(...)) at build time.
Optional token introspection — fall back to the provider's introspection endpoint for opaque tokens.

Quickstart

[dependencies]
klieo-auth-oauth = "3"

use klieo_auth_oauth::OAuthAuthenticator;

# async fn run() -> Result<(), klieo_auth_oauth::OAuthError> {
let auth = OAuthAuthenticator::from_oidc(
    "https://accounts.google.com",
    "your-client-id",
).await?;
# let _ = auth; Ok(()) }

OAuthAuthenticator::from_oidc(issuer, audience) wraps OIDC discovery + JWKS fetch + build in one call. Defaults to algorithm allowlist [RS256, ES256] and an empty required_scopes map. Empty required_scopes denies every method — authorize_method requires an entry per method (empty Vec allows any authenticated principal for that method; non-empty Vec requires at least one matching scope). Call .builder().required_scopes(...) to allow-list per-method scopes once you know which methods your transport exposes.

Advanced wiring — fluent builder

Reach for the builder when you need a method-to-scope allow-list, custom algorithms, an existing reqwest::Client, opaque-token introspection, or a token-cache capacity override:

use klieo_auth_oauth::OAuthAuthenticator;

# async fn run() -> Result<(), klieo_auth_oauth::OAuthError> {
let auth = OAuthAuthenticator::builder()
    .with_discovery("https://accounts.google.com").await?
    .audience("your-client-id")
    .build()
    .await?;
# let _ = auth; Ok(()) }

Static JWKS URI

use klieo_auth_oauth::OAuthAuthenticator;

let auth = OAuthAuthenticator::builder()
    .issuer_url("https://accounts.google.com")
    .audience("your-client-id")   // required since 0.37
    .jwks_uri("https://www.googleapis.com/oauth2/v3/certs")  // optional with discovery
    .build()
    .await?;

Note: .audience() is required — omitting it returns Err(OAuthError::Misconfigured(...)) at build time and the server will refuse to start.

Wire into a server builder

use std::sync::Arc;
use klieo_auth_oauth::OAuthAuthenticator;

let auth = Arc::new(
    OAuthAuthenticator::builder()
        .with_discovery("https://accounts.google.com").await?
        .audience("your-client-id")
        .build()
        .await?
);

// A2A dispatcher
let dispatcher = A2aDispatcherBuilder::new()
    .authenticator(auth.clone())
    // ...
    .build().await?;

// MCP server
let server = McpServerBuilder::new()
    .with_authenticator(auth)
    // ...
    .build_arc()?;

Status

3.x — stable. See docs/SEMVER.md.

License

MIT — see LICENSE.

klieo-auth-oauth 3.3.0