Modules
A vendor-neutral OAuth 2.0 / OIDC authorization-server and resource-server engine.
RFC 6749 §4.1 authorization-code grant, with mandatory PKCE (RFC 7636, S256) and optional DPoP binding of the code (RFC 9449 §10).
The validated context a successfully redeemed authorization code yields.
Refuse to start a per-node ETS store on a clustered BEAM.
Storage seam for authorization codes.
Single-node ETS implementation of Attesto.CodeStore.
Immutable configuration a token operation runs against.
RFC 9449 - OAuth 2.0 Demonstrating Proof of Possession (DPoP).
Storage seam for server-issued DPoP nonces (RFC 9449 §8).
Single-node ETS implementation of Attesto.DPoP.NonceStore.
In-memory, TTL-bounded cache of seen DPoP proof jti values.
RFC 8414 - OAuth 2.0 Authorization Server Metadata.
RFC 7517 - publish the signing keys' public halves as a JWK Set.
Pure helpers for working with the RSA signing material as PEM strings.
The behaviour Attesto uses to obtain signing and verification keys.
A simple Attesto.Keystore backed by application configuration.
RFC 8705 - OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens.
RFC 7636 - Proof Key for Code Exchange (PKCE).
Authenticate a protected-resource request: verify the access token and, for a DPoP-bound or mTLS-bound token, the sender-constraint proof.
Render the RFC 6750 / RFC 9449 error responses for the Attesto plugs.
Authorize a request against the scopes on the verified token.
One kind of subject a token can describe.
Storage seam for refresh tokens, with the atomic primitive that makes reuse detection possible.
Single-node ETS implementation of Attesto.RefreshStore.
Refresh-token issuance and rotation with reuse detection (RFC 6749 §6 / §10.4, OAuth 2.0 Security BCP).
RFC 7009 - OAuth 2.0 Token Revocation, for refresh tokens.
Scope grant-form matching for OAuth-style <resource>.<action> scopes.
Generate and hash the opaque secrets that back stateful grants.
Constant-time comparison of two binaries.
Canonical SHA-256 thumbprint shape, shared across the sender-constraint schemes.
Mint and verify RS256 JWT access tokens.