tokens

Token endpoint calls as Effects: exchange an authorization code for DPoP-bound tokens, refresh them with the rotating refresh token, and best-effort revocation. Confidential clients pass client-assertion fields via extra_form. The Tokens type is the single shared copy.

Types

Tokens

pub type Tokens {
  Tokens(
    access_token: String,
    refresh_token: String,
    sub: String,
    expires_in: Int,
  )
}

Constructors

Tokens(
  access_token: String,
  refresh_token: String,
  sub: String,
  expires_in: Int,
)

Values

exchange_code

pub fn exchange_code(
  token_endpoint token_endpoint: String,
  code code: String,
  redirect_uri redirect_uri: String,
  client_id client_id: String,
  pkce_verifier pkce_verifier: String,
  extra_form extra_form: List(#(String, String)),
) -> effect.Effect(Result(Tokens, String))

refresh

pub fn refresh(
  token_endpoint token_endpoint: String,
  refresh_token refresh_token: String,
  client_id client_id: String,
  extra_form extra_form: List(#(String, String)),
) -> effect.Effect(Result(Tokens, String))

revoke

pub fn revoke(
  issuer issuer: String,
  refresh_token refresh_token: String,
  client_id client_id: String,
  extra_form extra_form: List(#(String, String)),
) -> effect.Effect(Nil)

Best-effort refresh-token revocation at logout: discover the AS revocation endpoint from the issuer and revoke. Failures are ignored (the caller clears its local session regardless).