Modules
Framework-neutral OAuth and MCP authorization primitives.
Validates an OAuth authorization-code request before client lookup or consent.
Routes explicit OAuth token-endpoint client authentication methods.
Validates public clients using token_endpoint_auth_method=none.
Validates RFC 7523 private-key JWT client authentication.
Validates OAuth Client ID Metadata Documents and returns normalized metadata.
A fetch behaviour for OAuth Client ID Metadata Documents.
The default SSRF-resistant Req client-metadata fetcher.
Normalizes public-client Dynamic Client Registration metadata.
A clock behaviour for deterministic protocol tests.
Cryptographic helpers for opaque OAuth credentials and their digests.
A bounded OAuth protocol error independent of any HTTP framework.
Builds and validates RFC 7662-style token introspection values.
Validates, selects, and publishes JSON Web Key Sets.
A validated JWKS indexed by key ID.
Asymmetric JWT access-token signing and verification.
A behaviour for application-owned signing and verification keys.
Builds RFC 8414 authorization-server metadata.
Builds RFC 9728 protected-resource metadata.
PKCE S256 validation and verification as defined by RFC 7636.
A cryptographically secure random-byte source behaviour.
Computes refresh-token rotation and replay decisions without persistence.
A persistence-neutral refresh rotation decision.
Application-supplied persisted refresh-token state.
Fetches bounded JSON documents through an SSRF-resistant network policy.
Atomically claims a client-scoped assertion-ID digest until its acceptance window ends.
Parses bounded RFC 7009 token revocation requests.
Normalizes space-delimited OAuth scopes against an explicit catalogue.
Parses bounded authorization-code and refresh-token requests.
OAuth URI validation helpers, including native-app loopback redirects.