Modules
A Phoenix/Ecto OAuth 2.0 / OIDC authorization-server and
resource-server layer built on top of Attesto.
CIBA backchannel authentication request processing (OpenID Connect CIBA Core 1.0 §7), as conn-free core.
Plain-data backchannel authentication request the controller builds from the conn.
Records an end-user's decision on a pending CIBA authentication request and,
for a ping-mode request, delivers the §10.2 notification - so a host's
authentication-device UI does not hand-roll the approve→notify sequence.
Device authorization request processing (RFC 8628 §3.1 / §3.2), as conn-free core.
Plain-data device-authorization request the controller builds from the conn.
The resource server's half of the Identity Assertion JWT Authorization Grant
(ID-JAG), the grant behind MCP Enterprise-Managed Authorization (EMA) -
draft-ietf-oauth-identity-assertion-authz-grant-04.
Shared host metadata for the RFC 8414 and OpenID Provider documents.
Pushed Authorization Request storage (RFC 9126), as conn-free core.
A parsed Pushed Authorization Request (RFC 9126), all plain data lifted at the controller edge.
Conn-free derivation of the signed-request-object (JAR / RFC 9101 §10.5) discovery metadata shared by the OpenID Provider Metadata document (OpenID Connect Discovery) and the OAuth 2.0 Authorization Server Metadata document (RFC 8414).
Conn-free resolution of the per-request authorization-request validation policy shared by the authorization endpoint and the PAR endpoint.
Sender-constraint resolution for the token endpoint (RFC 9449 / RFC 8705), as conn-free core.
Token-endpoint grant processing (RFC 6749 §3.2), as conn-free core.
A parsed token request, all plain data lifted at the controller edge.
The seam for delivering a Back-Channel Logout logout_token to a Relying
Party (OpenID Connect Back-Channel Logout 1.0 §2.5).
Default AttestoPhoenix.BackChannelLogout deliverer, built on Req.
The OP browser-state cookie (OpenID Connect Session Management 1.0 §3.2).
The seam for delivering a CIBA ping-mode notification to a client (OpenID Connect CIBA Core 1.0 §10.2).
Default AttestoPhoenix.CIBAPing deliverer, built on Req.
Invocation of configured callbacks in the forms accepted throughout the library.
The host-owned UserInfo claim source (OpenID Connect Core §5).
OAuth 2.0 client authentication (RFC 6749 §2.3), as conn-free core.
Transport facts known while classifying client authentication.
The per-caller policy for AttestoPhoenix.ClientAuthentication.
The authenticated client and how it authenticated.
Integration façade for Client ID Metadata Documents - CIMD
(draft-ietf-oauth-client-id-metadata-document-01, IETF OAuth WG).
Behaviour for caching a validated Client ID Metadata Document - CIMD
(draft-ietf-oauth-client-id-metadata-document-01, IETF OAuth WG).
Single-node ETS AttestoPhoenix.ClientIdMetadata.Cache - CIMD
(draft-ietf-oauth-client-id-metadata-document-01, IETF OAuth WG).
Postgres-backed AttestoPhoenix.ClientIdMetadata.Cache for clustered
deployments - CIMD (draft-ietf-oauth-client-id-metadata-document-01, IETF
OAuth WG).
The wrapper that marks a client as having been resolved through CIMD.
Behaviour for dereferencing a Client ID Metadata Document URL - CIMD
(draft-ietf-oauth-client-id-metadata-document-01, IETF OAuth WG).
The default, SSRF-guarded Client ID Metadata Document fetcher - CIMD
(draft-ietf-oauth-client-id-metadata-document-01, IETF OAuth WG).
Resolves a Client ID Metadata Document URL into a client - CIMD
(draft-ietf-oauth-client-id-metadata-document-01, IETF OAuth WG).
The host-owned OAuth client registry contract (RFC 6749 §2 / §3.1.2).
Configuration for the attesto_phoenix authorization-server layer.
The request binding a single-use consent grant is tied to, and the canonical hash over it (RFC 6749 §4.1.1).
Behaviour for single-use, request-bound consent grants (RFC 6749 §4.1.1).
The host-owned resource-owner authentication and consent contract (RFC 6749 §3.1 / §4.1.1, OpenID Connect Core §3.1.2).
OAuth 2.0 / OpenID Connect authorization endpoint (RFC 6749 §3.1, OIDC Core §3.1.2).
OpenID Connect CIBA backchannel authentication endpoint (CIBA Core 1.0 §7.1).
The check_session_iframe (OpenID Connect Session Management 1.0 §3.3).
OID4VCI Credential Endpoint (draft-ietf-oauth-openid4vci §8.2).
OID4VCI Credential Issuer Metadata endpoint
(draft-ietf-oauth-openid4vci §11.2).
OID4VCI by-reference Credential Offer endpoint
(draft-ietf-oauth-openid4vci §4.1.3).
OID4VCI Deferred Credential Endpoint (draft-ietf-oauth-openid4vci §9).
OAuth 2.0 Device Authorization Endpoint (RFC 8628 §3.1).
Device verification page (RFC 8628 §3.3).
RFC 8414 - OAuth 2.0 Authorization Server Metadata endpoint.
End-session endpoint (OpenID Connect RP-Initiated Logout 1.0 §2 + Back-Channel Logout 1.0 + Front-Channel Logout 1.0).
OpenID Federation 1.0 Entity Configuration endpoint.
POST /oauth/introspect - OAuth 2.0 Token Introspection (RFC 7662), with the
signed-JWT response of RFC 9701 (FAPI 2.0 Message Signing §5.5).
GET /.well-known/jwks.json - the JSON Web Key Set (RFC 7517 §5).
SD-JWT VC JWT VC Issuer Metadata endpoint
(draft-ietf-oauth-sd-jwt-vc §5).
OID4VCI c_nonce endpoint (draft-ietf-oauth-openid4vci §7).
OpenID Connect Discovery 1.0 - OpenID Provider Metadata endpoint.
Pushed Authorization Request endpoint (RFC 9126).
Public OID4VP request_uri endpoint.
Public OID4VP direct-post response endpoint.
RFC 9728 - OAuth 2.0 Protected Resource Metadata endpoint.
OAuth 2.0 Dynamic Client Registration endpoint (RFC 7591 §3).
POST /oauth/revoke - OAuth 2.0 Token Revocation (RFC 7009).
IETF Token Status List endpoint.
OAuth 2.0 token endpoint (RFC 6749 §3.2).
OpenID Connect UserInfo endpoint (OpenID Connect Core 1.0 §5.3).
Resolve the callback and option boundary between AttestoPhoenix.Config and
Attesto.DPoP.
A one-line, dev-only helper that wires a locally-trusted TLS certificate into a
Phoenix endpoint's https: listener.
Neutral event struct and dispatcher for the optional :on_event callback.
The host-owned audit/telemetry contract.
The error value type and the wire-rendering helpers for the authorization-server controllers and the protected-resource plugs.
OpenApiSpex operation and schema values for the OAuth 2.0 token endpoint.
Behaviour for Pushed Authorization Request storage (RFC 9126).
Phoenix-friendly protected-resource authentication.
Phoenix alias for Attesto.Plug.RequireScopes.
The host-owned subject/principal contract.
Shared protected-resource authentication for Phoenix endpoints.
Authenticated encryption for the successor stored during refresh rotation.
The host-owned dynamic client registration persistence contract (RFC 7591 §3 / RFC 7592 §2).
Neutral request-fact helpers the OAuth 2.0 / OIDC flows derive from a Plug.Conn.
Resolves the trusted RFC 8707 audience set for an Attesto access token.
Router macro that mounts the authorization-server endpoints.
Ecto schema for the single-use authorization codes backing an
Attesto.CodeStore.
Ecto schema + record bridge for the CIBA authentication-request store
(AttestoPhoenix.Store.EctoCIBAStore).
Ecto schema for one cached Client ID Metadata Document - CIMD
(draft-ietf-oauth-client-id-metadata-document-01, IETF OAuth WG).
Ecto schema for a single-use, request-bound consent grant (RFC 6749 §4.1.1).
Ecto schema for a single server-issued DPoP nonce (RFC 9449 §8).
Ecto schema for one recorded DPoP proof jti (JWT ID).
Ecto schema + record bridge for the RFC 8628 device-code store
(AttestoPhoenix.Store.EctoDeviceCodeStore).
Ecto schema + record bridge for the logout session store
(AttestoPhoenix.Store.EctoLogoutSessionStore).
Ecto schema for a single Pushed Authorization Request (RFC 9126).
Ecto schema for the refresh-token records that back an Ecto-backed
Attesto.RefreshStore.
The host-owned scope-authorization contract (RFC 6749 §3.3).
Lazily creates and owns the library's named ETS tables.
Ecto/Postgres implementation of Attesto.CIBAStore.
Ecto implementation of the Attesto.CodeStore behaviour.
Postgres-backed AttestoPhoenix.ConsentGrantStore (RFC 6749 §4.1.1).
Ecto/Postgres implementation of Attesto.DeviceCodeStore.
Ecto/Postgres implementation of Attesto.LogoutSessionStore.
Postgres-backed Attesto.DPoP.NonceStore for clustered deployments
(RFC 9449 §8).
Postgres-backed AttestoPhoenix.PARStore for clustered deployments
(RFC 9126).
Ecto implementation of the Attesto.RefreshStore behaviour.
Ecto-backed, shared-store jti replay check for DPoP proofs
(RFC 9449 §11.1).
Dispatch to the configured Attesto.DPoP.NonceStore, threading the live
request %AttestoPhoenix.Config{} to stores that need it (RFC 9449 §8).
Single-node ETS Pushed Authorization Request store.
Optional periodic housekeeping GenServer that deletes expired rows from the
Ecto-backed authorization-code, refresh-token, device-code, CIBA-request,
logout-session, DPoP-nonce, DPoP-replay, pushed-authorization-request,
client-id-metadata-cache, and consent-grant tables.
Host-facing OID4VP verifier API.
Mix Tasks
Sets up a locally-trusted TLS certificate so a dev endpoint can serve
https://localhost with no tunnel and no downgrade.
Generates an Ecto migration that creates the persistence backing the
Ecto-based stores ship with attesto_phoenix.
Installs the attesto_phoenix authorization-server layer into a Phoenix app