# AttestoClient v2.3.1 - Table of Contents

> Secure OpenID Connect code + PKCE, refresh, revocation, logout, and OAuth 2.0 / FAPI client artifacts and verification.

## Pages

- [AttestoClient](readme.md)

- Guides
  - [Authorization Code + PKCE](authorization-code.md)
  - [Remote issuer resource server](resource-server.md)
  - [🪪 A digital identity wallet, end to end, in Elixir](digital_wallet.md)

- Changelog
  - [Changelog](changelog.md)

- License
  - [LICENSE](license.md)

## Modules

- [AttestoClient](AttestoClient.md): Client-side OAuth 2.0 / OpenID Connect / FAPI 2.0 artifacts and verification.
- [AttestoClient.AuthorizationCode](AttestoClient.AuthorizationCode.md): OpenID Connect Authorization Code flow with S256 PKCE.
- [AttestoClient.AuthorizationTransaction](AttestoClient.AuthorizationTransaction.md): One-time state for an OpenID Connect authorization transaction.
- [AttestoClient.AuthorizationTransaction.Store](AttestoClient.AuthorizationTransaction.Store.md): Storage contract for replay-safe authorization transactions.
- [AttestoClient.AuthorizationTransaction.Store.ETS](AttestoClient.AuthorizationTransaction.Store.ETS.md): Single-node authorization transaction store backed by a private ETS table.
- [AttestoClient.ClientAssertion](AttestoClient.ClientAssertion.md): Build `private_key_jwt` client-authentication assertions (RFC 7523 §2.2 /
OpenID Connect Core §9), signed with the client's own private key.
- [AttestoClient.DPoP](AttestoClient.DPoP.md): Build DPoP proof JWTs (RFC 9449 §4), the client-side mirror of
`Attesto.DPoP.verify_proof/2`.
- [AttestoClient.Discovery](AttestoClient.Discovery.md): Fetch and read OAuth 2.0 / OpenID Connect authorization-server metadata
(RFC 8414 / OpenID Connect Discovery 1.0).
- [AttestoClient.IDToken](AttestoClient.IDToken.md): Verify OpenID Connect ID Tokens issued by an authorization server.
- [AttestoClient.IdentityAssertion](AttestoClient.IdentityAssertion.md): Build Identity Assertion JWT Authorization Grant assertions (ID-JAG / EMA).
- [AttestoClient.JARM](AttestoClient.JARM.md): Verify JWT Secured Authorization Response Mode (JARM) responses, the
client-side mirror of `Attesto.JARM.response_jwt/4`.
- [AttestoClient.KeyAttestation](AttestoClient.KeyAttestation.md): Build an OID4VCI Key Attestation JWT (OpenID4VCI 1.0 "Key Attestation in JWT
format" §D.1), the client-side mirror of `Attesto.KeyAttestation.verify/2`.
- [AttestoClient.Logout](AttestoClient.Logout.md): Build an OpenID Connect RP-Initiated Logout request.
- [AttestoClient.PKCE](AttestoClient.PKCE.md): Generate RFC 7636 PKCE verifier/challenge pairs for OAuth clients.
- [AttestoClient.RefreshCoordinator](AttestoClient.RefreshCoordinator.md): Single-flight coordinator for refresh-token rotation.
- [AttestoClient.RefreshResult](AttestoClient.RefreshResult.md): Result shared by one refresh-token rotation flight.
- [AttestoClient.RequestObject](AttestoClient.RequestObject.md): Build signed authorization request objects (JAR, RFC 9101), the client-side
mirror of `Attesto.RequestObject.verify/3`.
- [AttestoClient.ResourceServer](AttestoClient.ResourceServer.md): Verify JWT access tokens issued by a remote OAuth authorization server.
- [AttestoClient.ResourceServer.Plug](AttestoClient.ResourceServer.Plug.md): Authenticate a Plug request with `AttestoClient.ResourceServer`.
- [AttestoClient.SignedIntrospection](AttestoClient.SignedIntrospection.md): Verify RFC 9701 signed token introspection responses.
- [AttestoClient.Token](AttestoClient.Token.md): Refresh and revoke OAuth tokens.
- [AttestoClient.TokenSet](AttestoClient.TokenSet.md): Validated token-endpoint response.
- [AttestoClient.UserInfo](AttestoClient.UserInfo.md): Verify signed OpenID Connect UserInfo responses.
- [AttestoClient.Wallet](AttestoClient.Wallet.md): OID4VCI Wallet (Holder) issuance flow (`draft-ietf-oauth-openid4vci`).
- [AttestoClient.Wallet.CredentialOffer](AttestoClient.Wallet.CredentialOffer.md): Parse an OID4VCI Credential Offer (`draft-ietf-oauth-openid4vci` §4.1) the
wallet receives - the holder-side mirror of `Attesto.CredentialOffer.build/1`.
- [AttestoClient.Wallet.Presentation](AttestoClient.Wallet.Presentation.md): OID4VP Presentation (holder/wallet) flow (`draft-ietf-oauth-openid4vp`).
- [AttestoClient.Wallet.Presentation.Mdoc](AttestoClient.Wallet.Presentation.Mdoc.md): Build an OID4VP `mso_mdoc` presentation - a full ISO 18013-5
`DeviceResponse` - the holder-side mirror of
`Attesto.Mdoc.verify_device_response/4`.
- [AttestoClient.Wallet.PresentationRequest](AttestoClient.Wallet.PresentationRequest.md): Parse and verify an OID4VP Authorization Request the wallet receives
(`draft-ietf-oauth-openid4vp` §5) - the holder-side mirror of
`Attesto.PresentationRequest.build/1`.
- [AttestoClient.Wallet.Proof](AttestoClient.Wallet.Proof.md): Build the OID4VCI holder key proof of possession
(`draft-ietf-oauth-openid4vci` §8.2.1.1), the wallet-side mirror of
`Attesto.CredentialProof.verify_jwt/2`.
- [AttestoClient.WalletAttestation](AttestoClient.WalletAttestation.md): Build the two JWTs of OAuth 2.0 Attestation-Based Client Authentication
(`draft-ietf-oauth-attestation-based-client-auth-10`), the client-side mirror
of `Attesto.WalletAttestation.verify/3` and the client-auth method OID4VCI
recommends for native-app wallets over `private_key_jwt`/mTLS.

