transport

Shared OAuth transport: a form-encoded POST carrying a DPoP proof, with the mandatory nonce retry (first attempt no nonce, retry with the server’s DPoP-Nonce on use_dpop_nonce). The response is returned as-is.

Values

dpop_nonce_challenge

pub fn dpop_nonce_challenge(
  resp: response.Response(String),
) -> option.Option(String)

The DPoP nonce a server is asking us to use, if it rejected the request with use_dpop_nonce. The authorization server (PAR/token) signals this in the JSON body; the PDS resource server signals it in the WWW-Authenticate header. Either way the nonce itself comes in the DPoP-Nonce header.

post_form_with_dpop

pub fn post_form_with_dpop(
  client: xrpc.Client,
  url: String,
  form: List(#(String, String)),
  dpop_key: gose.Key(String),
) -> Result(response.Response(String), String)