Struct ProviderSpec 

pub struct ProviderSpec {

    pub id: &'static str,
    pub display_name: &'static str,
    pub auth_url: &'static str,
    pub token_url: &'static str,
    pub userinfo_url: Option<&'static str>,
    pub scopes: &'static str,
    pub scope_separator: &'static str,
    pub client_id_param: &'static str,
    pub auth_query_extra: &'static str,
    pub requires_pkce: bool,
    pub userinfo_method: UserinfoMethod,
    pub userinfo_parser: UserinfoParser,
    pub token_exchange: TokenExchangeShape,
    pub token_response_json: bool,
}

Static description of one OAuth/OIDC provider. Endpoint URLs are formatted with {tenant} etc. placeholders that the spec resolves when given a runtime config (e.g. Microsoft swaps {tenant} for the configured Azure tenant id).

Fields

id: &'static str

Stable id used in the dashboard URL and the Account.provider column. Lowercase ASCII; matches /api/auth/login/<id>.

display_name: &'static str

Human-readable name for buttons / UIs.

auth_url: &'static str

Authorization endpoint — where we send the user to grant access. May contain {tenant} for tenant-aware providers (Microsoft).

token_url: &'static str

Token exchange endpoint — POST’d with the auth code to get access + refresh tokens.

userinfo_url: Option<&'static str>

Userinfo endpoint — GET’d with the access token to pull the authed user’s profile. None for providers that put the identity inside the id_token JWT only (Apple).

scopes: &'static str

OAuth scope string the spec asks for. Defaults to the minimum needed to ID the user. Separator is Self::scope_separator.

scope_separator: &'static str

Scope separator. RFC 6749 says space; TikTok uses comma.

client_id_param: &'static str

Form-field name for the OAuth client_id. RFC 6749 says client_id; TikTok says client_key.

auth_query_extra: &'static str

Extra query parameters appended to the auth URL (already URL-encoded, no leading &). Apple needs response_mode=form_post when name/email scopes are requested; this is the hook for it.

requires_pkce: bool

PKCE — when true, pylon generates code_verifier / code_challenge (SHA-256, S256), sends the challenge on the auth request, and replays the verifier on token exchange. Twitter/X requires it; Google/Microsoft recommend it.

userinfo_method: UserinfoMethod

HTTP method used for the userinfo fetch. Most providers use GET; Dropbox uses POST.

userinfo_parser: UserinfoParser

How to extract (provider_account_id, email, display_name) from the provider’s userinfo response. Provider-stable id path (Google’s sub, GitHub’s id) is what Account keys on, NOT the email — a renamed-email user keeps their account.

token_exchange: TokenExchangeShape

Provider-specific oddities for token exchange.

token_response_json: bool

Whether the token endpoint expects an Accept: application/json header (required for GitHub’s classic OAuth, otherwise it returns form-urlencoded). Default true; flip false for providers that explicitly require form encoding.

Trait Implementations

impl Clone for ProviderSpec

fn clone(&self) -> ProviderSpec

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ProviderSpec

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.