Modules
Client-side OAuth 2.0 / OpenID Connect / FAPI 2.0 artifacts and verification.
OpenID Connect Authorization Code flow with S256 PKCE.
One-time state for an OpenID Connect authorization transaction.
Storage contract for replay-safe authorization transactions.
Single-node authorization transaction store backed by a private ETS table.
Build private_key_jwt client-authentication assertions (RFC 7523 §2.2 /
OpenID Connect Core §9), signed with the client's own private key.
Build DPoP proof JWTs (RFC 9449 §4), the client-side mirror of
Attesto.DPoP.verify_proof/2.
Fetch and read OAuth 2.0 / OpenID Connect authorization-server metadata (RFC 8414 / OpenID Connect Discovery 1.0).
Verify OpenID Connect ID Tokens issued by an authorization server.
Build Identity Assertion JWT Authorization Grant assertions (ID-JAG / EMA).
Verify JWT Secured Authorization Response Mode (JARM) responses, the
client-side mirror of Attesto.JARM.response_jwt/4.
Build an OID4VCI Key Attestation JWT (OpenID4VCI 1.0 "Key Attestation in JWT
format" §D.1), the client-side mirror of Attesto.KeyAttestation.verify/2.
Build an OpenID Connect RP-Initiated Logout request.
Generate RFC 7636 PKCE verifier/challenge pairs for OAuth clients.
Single-flight coordinator for refresh-token rotation.
Result shared by one refresh-token rotation flight.
Build signed authorization request objects (JAR, RFC 9101), the client-side
mirror of Attesto.RequestObject.verify/3.
Verify JWT access tokens issued by a remote OAuth authorization server.
Authenticate a Plug request with AttestoClient.ResourceServer.
Verify RFC 9701 signed token introspection responses.
Refresh and revoke OAuth tokens.
Validated token-endpoint response.
Verify signed OpenID Connect UserInfo responses.
OID4VCI Wallet (Holder) issuance flow (draft-ietf-oauth-openid4vci).
Parse an OID4VCI Credential Offer (draft-ietf-oauth-openid4vci §4.1) the
wallet receives - the holder-side mirror of Attesto.CredentialOffer.build/1.
OID4VP Presentation (holder/wallet) flow (draft-ietf-oauth-openid4vp).
Build an OID4VP mso_mdoc presentation - a full ISO 18013-5
DeviceResponse - the holder-side mirror of
Attesto.Mdoc.verify_device_response/4.
Parse and verify an OID4VP Authorization Request the wallet receives
(draft-ietf-oauth-openid4vp §5) - the holder-side mirror of
Attesto.PresentationRequest.build/1.
Build the OID4VCI holder key proof of possession
(draft-ietf-oauth-openid4vci §8.2.1.1), the wallet-side mirror of
Attesto.CredentialProof.verify_jwt/2.
Build the two JWTs of OAuth 2.0 Attestation-Based Client Authentication
(draft-ietf-oauth-attestation-based-client-auth-10), the client-side mirror
of Attesto.WalletAttestation.verify/3 and the client-auth method OID4VCI
recommends for native-app wallets over private_key_jwt/mTLS.