API Reference latch v#0.4.0

at-uris are used to reference individual records within a repository, identified by did or handle. This module implements the restricted grammar used in Lexicons.

Authenticated XRPC for a logged in did, with transparent token refresh.

Client assertion JWTs (RFC 7523 private_key_jwt) for atproto OAuth.

Client metadata document for atproto OAuth.

The configuration that drives the client.

DID syntax validation per the atproto DID spec.

Parses atproto DID documents to extract the claimed handle and PDS endpoint.

DNS transport boundary for atproto handle resolution.

DPoP (RFC 9449) proof JWTs for atproto OAuth, and server-issued nonce flow shared by Latch.XRPC and Latch.Flow.

Discovers the authorization server for a PDS and validates the binding between them, per the atproto OAuth profile.

Errors returned by the public Latch and Latch.Client API.

Authorization-server discovery failed for a PDS.

A handle reoslved to a DID, but the DID document does not read back to it, or it lacks a usable PDS endpoint.

A server response was structurally invalid, including bad JSON or a missing or malformed required field.

The server responded with use_dpop_nonce but did not provide a header to retry with. This is a server side issue.

No stored session exists for the given DID.

The authorization server returned an OAuth error response.

An integrity check required by the atproto OAuth spec failed. A caller must not treat the user as logged in when one of these is returned.

The caller's Latch.Store implementation returned an error. The specific callback is in the action field.

An HTTP request failed at the transport layer.

The PDS returned a non-2xx XRPC response.

Drives the atproto OAuth flow against an authorization server: pushed authorization requests, the authorization redirect, token exchange, and refresh.

HTTP transport boundary for atproto identify resolution.

Handle syntax validation and normalization per the atproto handle spec.

Resolves an atproto handle to a verified identity.

Namespaced identifiers are used in atproto to reference lexicons, XRPC endpoints, and more.

PKCE (RFC 7636) helpers for atproto OAuth.

Record keys have a defined set of allowed shapes: TID, NSID, literal:<value>, and any.

An in-flight atproto OAuth authorization request, keyed by state.

Parses authorization server metadata (/.well-known/oauth-authorization-server) per the atproto OAuth profile.

An established atproto OAuth session: the credentials and binding needed to make authenticated PDS requests and to refresh the access token.

Storage backend for in-flight OAuth requests and long-lived sessions.

Pre-built ETS Store for Latch. Does not maintain access tokens or in-progress requests across restarts. For a more reliable approach, create your own implementation of the Latch.Store behavior.

Timestamp identifiers, frequently used as record keys in atproto. Time-sortable, can be used as logical clocks within a system, and designed to reduce the risk of collisions.

Parses token endpoint responses per the atproto OAuth profile.

DPoP-authenticated XRPC calls to a session's PDS.