@spec access_token_hash(String.t()) :: String.t()

S256 hash of an access token for the ath claim (same as PKCE S256)

@spec generate_key() :: map()

Generates a new ES256 (P-256) key pair as a plain RFC 7517 JWK map.

@spec proof(map(), String.t(), String.t(), keyword()) :: String.t()

Signs a DPoP proof JWT for an HTTP request.

Arguments

• jwk — private plain JWK map for this OAuth session
• method — HTTP method (e.g. "POST")
• url — request URL; query string is stripped for htu per atproto

Options

• :nonce — server DPoP nonce (omit when unknown)
• :access_token — adds ath (S256 hash) for PDS/resource requests
• :jti — override jti (tests)
• :iat — override iat (tests) Note: atproto currently says do not include iss on PDS-bound proofs.

@spec thumbprint(map()) :: String.t()

RFC 7638 thumbprint of a plain JWK map.