Modules
Client-side OAuth 2.0 / OpenID Connect / FAPI 2.0 artifacts and verification.
OpenID Connect Authorization Code flow with S256 PKCE.
One-time state for an OpenID Connect authorization transaction.
Storage contract for replay-safe authorization transactions.
Single-node authorization transaction store backed by a private ETS table.
Build private_key_jwt client-authentication assertions (RFC 7523 §2.2 /
OpenID Connect Core §9), signed with the client's own private key.
Fetch and read OAuth 2.0 / OpenID Connect authorization-server metadata (RFC 8414 / OpenID Connect Discovery 1.0).
Verify OpenID Connect ID Tokens issued by an authorization server.
Build Identity Assertion JWT Authorization Grant assertions (ID-JAG / EMA).
Verify JWT Secured Authorization Response Mode (JARM) responses, the
client-side mirror of Attesto.JARM.response_jwt/4.
Build an OpenID Connect RP-Initiated Logout request.
Generate RFC 7636 PKCE verifier/challenge pairs for OAuth clients.
Single-flight coordinator for refresh-token rotation.
Result shared by one refresh-token rotation flight.
Build signed authorization request objects (JAR, RFC 9101), the client-side
mirror of Attesto.RequestObject.verify/3.
Verify JWT access tokens issued by a remote OAuth authorization server.
Authenticate a Plug request with AttestoClient.ResourceServer.
Verify RFC 9701 signed token introspection responses.
Refresh and revoke OAuth tokens.
Validated token-endpoint response.
Verify signed OpenID Connect UserInfo responses.