Struct AuthorizationCodeFlow 

pub struct AuthorizationCodeFlow {
    pub provider: IdentityProvider,
    pub client_id: String,
    pub scopes: Vec<String>,
    pub port: u16,
}

An OAuth2 Authorization Code flow with PKCE for supported identity providers.

This flow is designed for interactive user authentication. It opens the system browser to the provider’s authorization endpoint, starts a local HTTP server to receive the callback, and exchanges the authorization code for an access token.

Provider Requirements

Microsoft Entra ID

• The application must have Delegated permissions
• The redirect URI http://localhost:{port}/callback must be registered under Mobile and desktop applications in the Azure Portal
• Public client flows must be enabled

Auth0

• Application Type must be set to Native
• The redirect URI http://localhost:{port}/callback must be listed under Allowed Callback URLs
• Token Endpoint Authentication Method must be set to None
• Non-Verifiable Callback URI End-User Confirmation must be off

Fields

provider: IdentityProvider

The resolved identity provider with all required endpoint data.

client_id: String

The Application (Client) ID registered in Entra ID.

scopes: Vec<String>

The list of OAuth2 scopes to request.

For Microsoft use delegated scopes (e.g. User.Read). For Auth0 use explicit scopes (e.g. read:ez).

port: u16

The local port to listen on for the OAuth2 redirect callback.

Must match the redirect URI registered with your identity provider (e.g. http://localhost:3000/callback).

Trait Implementations

impl Authenticator for AuthorizationCodeFlow

async fn get_token(&self) -> Result<String>

Performs the full Authorization Code + PKCE flow and returns an access token.

Steps:

1. Builds the authorization URL with a PKCE challenge
2. Starts a local HTTP server to receive the callback
3. Opens the system browser to the authorization URL
4. Waits for the authorization code via the local server (120s timeout)
5. Exchanges the code for an access token

For Auth0, an audience parameter is included automatically in the authorization request.

Errors

Returns an error if:

• The provider produces an invalid URL
• The local server fails to bind to the given port
• The browser authorization is denied or times out
• The token exchange with the identity provider fails