Modules
An OAuth 2.1 authorization server, configured per app via a single module.
Resource extension for OAuth 2.1 authorization-code rows.
Action helpers for resources extended with
AshAuthentication.Oauth2Server.AuthorizationCodeResource.
Introspection helpers for the
AshAuthentication.Oauth2Server.AuthorizationCodeResource extension.
Verifies that an OAuth2 authorization-code resource declares every
attribute the Authorize and Token cores read or write.
Protocol-pure logic for the /oauth/authorize endpoint.
OAuth Client ID Metadata Documents (draft-ietf-oauth-client-id-metadata-document).
ETS cache for fetched Client ID Metadata Documents.
Behaviour for fetching OAuth Client ID Metadata Documents.
The default Client ID Metadata Document fetcher, built on Req.
Change that rotates a refresh-token row atomically.
Shared validation for OAuth client metadata, whichever way it arrives —
a Dynamic Client Registration request body (RFC 7591) or a fetched
Client ID Metadata Document. Both are JSON objects with the same
field vocabulary, and this server accepts the same subset from each:
public clients only (token_endpoint_auth_method: "none"), the
authorization_code + refresh_token grants, and code responses.
A GenServer which periodically removes expired OAuth2 authorization
codes and refresh tokens.
Mint and verify OAuth 2.1 access tokens.
Builders for the discovery metadata endpoints.
PKCE (RFC 7636) S256 helpers.
Resource extension for OAuth 2.1 refresh-token rows.
Action helpers for resources extended with
AshAuthentication.Oauth2Server.RefreshTokenResource.
Introspection helpers for the
AshAuthentication.Oauth2Server.RefreshTokenResource extension.
Verifies the refresh-token resource has the shape the Token core depends on
Protocol-pure logic for /oauth/register (RFC 7591 Dynamic Client
Registration).
Supervises the background processes for an OAuth2 server.
Protocol-pure logic for the /oauth/token endpoint.
Resource-server side bearer token validation.
Plug router for the human-driven consent step of the OAuth 2.1 flow.
Default HTML consent screen.
HTTP error response helpers for OAuth 2.1 / RFC 7591.
Plug router for the client-facing OAuth 2.1 protocol endpoints — anything called by an external OAuth client without a browser session.
Gate a pipeline on OAuth scopes, with spec-shaped errors.
Phoenix router macros for mounting the OAuth 2.1 authorization server.
Mix Tasks
Scaffolds an OAuth 2.1 authorization server