Crate oauth_toolkit 

Turnkey OAuth2/OIDC primitives for Rust.

Two capabilities lead the crate:

• RFC 8252 desktop loopback flow (loopback) — binds an ephemeral 127.0.0.1 port, builds the authorization URL with PKCE (S256) and a single-use state, captures exactly one redirect, then shuts down. The oauth2 crate ships protocol primitives but no turnkey loopback listener; this is one call: loopback::LoopbackFlow::start → open URL → loopback::LoopbackFlow::wait_for_code.
• Mail-provider presets (providers) — Gmail, Outlook, Yahoo, AOL, and Fastmail endpoints plus the IMAP/SMTP XOAUTH2 scope sets for desktop mail clients.

Around those: PKCE generation and server-side verification (pkce), token exchange/refresh (token), OIDC discovery and JWKS-backed validation (oidc, oidc_validator), social login (GitHub/Google, social), CSRF state (csrf), scope handling (scope), and HMAC/opaque-token crypto (crypto).

Scope note: oauth2 covers the full grant surface (client credentials, device code, extensions) and openidconnect validates ID tokens more deeply (nonce, at_hash, ES256, per-kid keys) — this crate trades that breadth for turnkey flows.

Modules

crypto

Cryptographic helpers for OAuth2 tokens and secrets.

csrf

CSRF state management with pluggable backends.

jwt

JWT helpers: HS256 (shared-secret) and ES256/RS256 (PEM-key, asymmetric) — the asymmetric pair is what any estate OIDC issuer needs (research loop wave 3b prerequisite).

loopback

Desktop loopback redirect capture (RFC 8252 §7.3).

oidc

OIDC discovery, token exchange, and user info.

oidc_validator

JWKS-backed OIDC token validation.

pkce

RFC 7636 PKCE (Proof Key for Code Exchange), as narrowed by OAuth 2.1.

providers

Mail provider presets for desktop IMAP/SMTP XOAUTH2 flows, plus the canonical endpoint URL constants shared by all provider modules.

redirect

Redirect URI validation for OAuth2.

scope

OAuth2 scope parsing and validation.

social

Social login providers (GitHub, Google).

token

OAuth2 token endpoint operations: authorization-code exchange (with PKCE verifier) and refresh-token rotation.