AttestoClient.AuthorizationTransaction (AttestoClient v2.9.0)

One-time state for an OAuth or OpenID Connect authorization transaction.

Transactions bind the callback to the issuer, client, redirect URI, nonce, PKCE verifier, and opaque initiating browser-session value that created it. They are deliberately stored behind the AttestoClient.AuthorizationTransaction.Store behaviour so applications can choose storage appropriate to their topology. The included ETS store is suitable for a single node; clustered deployments should provide a store with equivalent atomic put_new and take semantics.

Optional DPoP provenance pins the initiating public-key thumbprint; callback must use the same signing key. The explicit generic, HAIP, or FAPI profile and its authentication identity are pinned at start; callback options cannot weaken them. HAIP/FAPI require authenticated PAR and a DPoP private key. Authentication bindings retain public key identity or a secret digest rather than private keys or attestation JWTs.

A transaction contains protocol secrets, especially the PKCE verifier and browser binding. Never send it to the browser or log it.

Summary

Types

t()

Types

t()

@type t() :: %AttestoClient.AuthorizationTransaction{
  browser_binding: String.t(),
  client_auth_binding: map() | nil,
  client_id: String.t(),
  code_verifier: String.t(),
  dpop_jkt: String.t() | nil,
  id_token_alg: String.t() | nil,
  issuer: String.t(),
  max_age: non_neg_integer() | nil,
  metadata: map(),
  nonce: String.t(),
  profile: :generic | :haip | :fapi,
  protocol: :oidc | :oauth,
  redirect_uri: String.t(),
  require_response_issuer: boolean(),
  state: String.t()
}