TryErrorRedirect tries to handle an error by redirecting a client. If this attempt fails, an error is returned that must be returned to the client ins

ValidateAuthRequestClient validates the Auth request against the passed client. If id_token_hint is part of the request, the subject of the token is r

ValidateDPoPKeyStrength enforces minimum key strength for a DPoP proof-of-possession key: RSA 2048-8192 bits, EC curve P-256, P-384 or P-521, and Ed25

ValidateRefreshTokenScopes validates that the requested scope is a subset of the original auth request scope it will set the requested scopes as curre

VerifyAccessToken validates the access token according to https://openid.net/specs/openid-connect-core-1_0.html#CodeFlowTokenValidation

WithCookieHandler set a `CookieHandler` for securing the various redirects

WithDPoPJKT adds the `dpop_jkt` parameter from OpenID Connect Key Binding 1.0, Section 3.1 to a device authorization request. Experimental: OpenID Co

WithNonce sets the function to check the nonce

WithPKCEFromDiscovery enables Oauth2 Code Challenge if support is found in the discovery response from the OP. Passing this option to an Oauth2-only R

WithResponseModeURLParam sets the `response_mode` parameter in a URL.

WithSigningAlgsFromDiscovery appends the [WithSupportedSigningAlgorithms] option to the Verifier Options. The algorithms returned in the `id_token_sig

WithURLParam allows setting custom key-vale pairs to an OAuth2 URL.

checkURIAgainstRedirects just checks against the valid redirect URIs and ignores other factors.

createRefreshToken will store a refresh_token in-memory based on the provided information

customClaim demonstrates how to return custom claims based on provided information

htuKey returns a normalized version of the token endpoint URI for comparison per RFC 3986, sections 6.2.2 and 6.2.3.

jsonFilename builds a filename for the regression testdata. dataDir/<type_name>.json

keyBindingAlgMatchesKey reports whether alg can be produced by the public key pub. For the standard Go key types the pairing is fully determined (an E

withPrompt sets the `prompt` params in the auth request This is the generalized, unexported, function used by both URLParamOpt and AuthURLOpt.

AuthRequestByID implements the op.Storage interface it will be called after the Login UI redirects back to the OIDC endpoint

AuthResponse creates the successful authentication response (either code or tokens)

AuthResponseToken creates the successful token(s) authentication response

Authorize initiates the authorization flow and redirects to a login page. See the various https://openid.net/specs/openid-connect-core-1_0.html author

AuthorizeCallback handles the callback after authentication in the Login UI

AuthorizeCodeClient checks the authorization of the client and that the used method was the one previously registered. It than returns the auth reques

AuthorizeRefreshClient checks the authorization of the client and that the used method was the one previously registered. It than returns the data rep

AuthorizeTokenExchangeClient authorizes a client by validating the client_id and client_secret

BuildAuthRequestCode builds the string representation of the auth code

Deprecated: Use CheckIssuerWithISSVerifier instead

ClientCredentials requests an access token using the `client_credentials` grant, as defined in [RFC 6749, section 4.4]. As there is no user associate

ClientCredentialsExchange handles the OAuth 2.0 client_credentials grant, including parsing, validating, authorizing the client and finally returning

ClientCredentialsExchange handles the OAuth 2.0 client credentials grant It is called by the Token endpoint handler when grant_type has the value clie

ClientCredentialsGrantBasic creates an oauth2 `Client Credentials` Grant sending client_id and client_secret as basic auth header

CodeExchange handles the OAuth 2.0 authorization_code grant, including parsing, validating, authorizing the client and finally exchanging the code for

CodeExchange returns Tokens after an authorization code is obtained in a successful Authorize flow. It is called by the Token endpoint handler when gr

Deprecated: Use standard library [slices.Contains] instead.

CopyRequestObjectToAuthRequest overwrites present values from the Request Object into the auth request and clears the `RequestParam` of the auth reque

CreateAuthRequestCode creates and stores a code for the auth code response