Discover calls the discovery endpoint of the provided issuer and returns its configuration It accepts an optional argument "wellknownUrl" which can be

FindMatchingKey searches the given JSON Web Keys for the requested key ID, usage and alg type will return the key immediately if matches exact (id, u

JWKThumbprint returns the RFC 7638 SHA-256 thumbprint of jwk, encoded with unpadded base64url. Experimental: OpenID Connect Key Binding 1.0 is a draf

Authorize handles the authorization request, including parsing, validating, storing and finally redirecting to the login handler

ClientIDFromRequest parses the request form and tries to obtain the client ID and reports if it is authenticated, using a JWT or static client secrets

CodeExchangeHandler extends the `CodeExchange` method with an http handler including cookie handling for secure `state` transfer and optional PKCE cod

CodeHash returns the c_s256 value for an authorization or device code. Experimental: OpenID Connect Key Binding 1.0 is a draft standard. This API may

EXPECT returns an object that allows the caller to indicate expected use.

NewIssuerInterceptor will set the issuer into the context by the provided IssuerFromRequest (e.g. returned from StaticIssuer or IssuerFromHost)

NewLegacyServer wraps provider in a `Server` implementation Only non-nil endpoints will be registered on the router. Nil endpoints are disabled. The

VerifyAccessToken validates the access token (issuer, signature and expiration).

VerifyIDTokenHint validates the id token according to https://openid.net/specs/openid-connect-core-1_0.html#IDTokenValidation. In case of an expired t

WithIssuedAtOffset mitigates the risk of iat to be in the future because of clock skews with the ability to add an offset to the current time

WithPKCE sets the RP to use PKCE (oauth2 code challenge) it also sets a `CookieHandler` for securing the various redirects and exchanging the code cha

WithPromptURLParam sets the `prompt` parameter in a URL.

WithSupportedSigningAlgorithms overwrites the default RS256 signing algorithm

keyBindingHTTPClient returns a shallow copy of client whose transport adds a DPoP proof to a single token-endpoint request. tokenEndpoint pins the onl

setDefaultTestLogger installs a process-wide default logger for the duration of t. Do not use with t.Parallel(): slog.SetDefault is global and races a

setUserinfo sets the info based on the user, scopes and if necessary the clientID

AuthCallbackURL builds the url for the redirect (with the requestID) after a successful login

AuthorizeCodeChallenge authorizes a client by validating the code_verifier against the previously sent code_challenge of the auth request (PKCE)

AuthorizePrivateJWTKey authorizes a client by validating the client_assertion's signature with a previously registered public key (JWT Profile)

BuildAuthResponseCodeResponsePayload generates the authorization code response payload for the authentication request

CheckAZPVerifier checks azp (authorized party) claim requirements. If the ID Token contains multiple audiences, the Client SHOULD verify that an azp

CompleteDeviceAuthorization marks a device authorization entry as Completed, identified by userCode. The Subject is added to the state, so that GetDev

Deprecated: use [github.com/zitadel/zitadel-go/v3/pkg/client.ConfigFromKeyFile] instead. The type will be removed in the next major release.

Deprecated: use [github.com/zitadel/zitadel-go/v3/pkg/client.ConfigFromKeyFileData] instead. The type will be removed in the next major release.

GetKeyIDAndAlg returns the `kid` and `alg` claim from the JWS header

GetRefreshTokenInfo must return ErrInvalidRefreshToken when presented with a token that is not a refresh token.

GetSessionState returns session_state. session_state is related to OpenID Connect Session Management.