Modules
A vendor-neutral OAuth 2.0 / OIDC authorization-server and resource-server engine.
RFC 6749 §4.1 authorization-code grant, with mandatory PKCE (RFC 7636, S256) and optional DPoP binding of the code (RFC 9449 §10).
The validated context a successfully redeemed authorization code yields.
Authorization endpoint request validation (RFC 6749 §4.1.1, OIDC Core §3.1.2.1, RFC 7636 §4.3).
OpenID Connect Client-Initiated Backchannel Authentication (CIBA Core 1.0) - the conn-free core.
The validated context a successfully redeemed CIBA authentication request yields (CIBA Core §10.1).
A validated CIBA backchannel authentication request (CIBA Core §7.1).
Storage seam for the OpenID Connect CIBA grant
(urn:openid:params:grant-type:ciba).
Single-node ETS implementation of Attesto.CIBAStore.
Storage seam for server-issued OID4VCI c_nonces.
Single-node ETS implementation of Attesto.CNonceStore.
Shared mechanics for claim-key normalization and registered-claim merging.
private_key_jwt client authentication verification (RFC 7523 / OIDC Core).
Client ID Metadata Documents - CIMD
(draft-ietf-oauth-client-id-metadata-document-01, IETF OAuth WG).
Refuse to start a per-node ETS store on a clustered BEAM.
Storage seam for authorization codes.
Single-node ETS implementation of Attesto.CodeStore.
Immutable configuration a token operation runs against.
Minimal COSE helpers for ISO 18013-5 issuer authentication.
OID4VCI Credential Issuer Metadata
(draft-ietf-oauth-openid4vci §11.2).
OID4VCI Credential Offer (draft-ietf-oauth-openid4vci §4.1).
Storage seam for by-reference OID4VCI credential offers.
Single-node ETS implementation of Attesto.CredentialOfferStore.
OID4VCI credential-request key proof of type jwt
(draft-ietf-oauth-openid4vci §8.2.1.1).
OID4VCI Credential Request (draft-ietf-oauth-openid4vci §8.2).
OID4VCI Credential Response (draft-ietf-oauth-openid4vci §8.3).
RFC 9449 - OAuth 2.0 Demonstrating Proof of Possession (DPoP).
Storage seam for server-issued DPoP nonces (RFC 9449 §8).
Single-node ETS implementation of Attesto.DPoP.NonceStore.
In-memory, TTL-bounded cache of seen DPoP proof jti values.
RFC 8628 Device Authorization Grant — the conn-free core.
The validated context a successfully redeemed device code yields (RFC 8628 §3.4).
Storage seam for the RFC 8628 device authorization grant.
Single-node ETS implementation of Attesto.DeviceCodeStore.
Connection-free resolution for self-contained DID methods.
RFC 8414 - OAuth 2.0 Authorization Server Metadata.
Validate an OpenID Connect RP-Initiated Logout request (OpenID Connect RP-Initiated Logout 1.0 §2-3).
Build and verify OpenID Federation 1.0 Entity Statements.
OpenID Federation 1.0 metadata-policy resolution and application.
Validate an already-resolved OpenID Federation 1.0 Trust Chain.
OpenID Connect Front-Channel Logout 1.0 — the OP-side logout-URI builder.
Mint and verify OpenID Connect ID Tokens (OpenID Connect Core 1.0 §2).
Identity Assertion JWT Authorization Grant (ID-JAG) verification - the resource
Authorization Server's half of the Identity Assertion Authorization Grant
(draft-ietf-oauth-identity-assertion-authz-grant-04), the grant behind MCP
Enterprise-Managed Authorization (EMA).
OAuth 2.0 Token Introspection (RFC 7662), conn-free core.
JWT Secured Authorization Response Mode (JARM).
RFC 7517 - publish the signing keys' public halves as a JWK Set.
W3C Verifiable Credentials Data Model 1.1 credentials encoded as JWTs,
corresponding to the OID4VCI jwt_vc_json Credential Format.
Pure helpers for working with signing material as PEM strings.
OID4VCI Key Attestation in JWT format (OpenID4VCI 1.0 draft 15/ID2,
"Key Attestation in JWT format" §D.1, #keyattestation-jwt).
The behaviour Attesto uses to obtain signing and verification keys.
A simple Attesto.Keystore backed by application configuration.
Storage seam for OpenID Connect Back-Channel Logout 1.0 and Front-Channel Logout 1.0.
Mint OpenID Connect Back-Channel Logout logout_tokens
(OpenID Connect Back-Channel Logout 1.0 §2.4).
RFC 8705 - OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens.
Shared helpers for reading and validating protocol map parameters.
Issue and verify ISO 18013-5 mdoc credentials and OID4VP mdoc presentations.
Value-level helpers for JWT NumericDate comparisons and Unix-second clocks.
OpenID Connect Discovery 1.0 - OpenID Provider Metadata (§3).
RFC 7636 - Proof Key for Code Exchange (PKCE).
Authenticate a protected-resource request: verify the access token and, for a DPoP-bound or mTLS-bound token, the sender-constraint proof.
Render the RFC 6750 / RFC 9449 error responses for the Attesto plugs.
Authorize a request against the scopes on the verified token.
OID4VCI pre-authorized code issuance and redemption.
Storage seam for OID4VCI pre-authorized codes.
Single-node ETS implementation of Attesto.PreAuthorizedCodeStore.
OID4VP Authorization Request (draft-ietf-oauth-openid4vp §5).
Verifier-side OID4VP presentation-session state machine.
Storage seam for verifier-side OID4VP presentation sessions.
Single-node ETS implementation of Attesto.PresentationSessionStore.
One kind of subject a token can describe.
RFC 9728 - OAuth 2.0 Protected Resource Metadata.
Redirect-URI matching for the authorization endpoint (RFC 6749 §3.1.2.3, RFC 8252 §7.3).
Storage seam for refresh tokens, with the atomic primitive that makes reuse detection possible.
Single-node ETS implementation of Attesto.RefreshStore.
Refresh-token issuance and rotation with reuse detection (RFC 6749 §6 / §10.4, OAuth 2.0 Security BCP).
Signed OpenID Connect Request Object verification (JAR, RFC 9101 / OIDC §6.1).
Verification policy for signed authorization request objects (JAR, RFC 9101).
RFC 8707 Resource Indicators for OAuth 2.0 — the conn-free primitive.
RFC 7009 - OAuth 2.0 Token Revocation, for refresh tokens.
Scope grant-form matching for OAuth-style <resource>.<action> scopes.
Selective Disclosure for JWTs (SD-JWT), draft-ietf-oauth-selective-disclosure-jwt.
SD-JWT-based Verifiable Credentials (SD-JWT VC), draft-ietf-oauth-sd-jwt-vc.
Generate and hash the opaque secrets that back stateful grants.
Result-independent comparison of two binaries.
OpenID Connect Session Management 1.0 — the session_state value.
JWT response for OAuth 2.0 Token Introspection (RFC 9701).
Key-derived JOSE signing algorithm helpers.
SIOPv2 Self-Issued ID Token verification for the Relying Party role.
IETF Token Status List construction and verification.
Storage seam for issuer-managed Token Status Lists.
Single-node ETS implementation of Attesto.StatusListStore.
RFC 9470 Step-Up Authentication Challenge — the conn-free core primitive.
A normalized RFC 9470 step-up authentication requirement for a protected route.
:telemetry events Attesto emits for security-relevant refusals.
DPoP test fixtures for host application suites.
Server-side DPoP verification harness for host application test suites.
Canonical SHA-256 thumbprint shape, shared across the sender-constraint schemes.
Mint and verify JWT access tokens with trusted, key-bound algorithms.
OID4VP vp_token verification for SD-JWT VC (dc+sd-jwt) and ISO mdoc
(mso_mdoc) presentations (OID4VP §7).
OAuth 2.0 Attestation-Based Client Authentication
(draft-ietf-oauth-attestation-based-client-auth-10, 2026-07-06), the
"Wallet Attestation" client authentication method OID4VCI recommends for
native-app Wallets in place of private_key_jwt/mTLS.