WithAuthTimeMaxAge provides the ability to define the maximum duration between auth_time and now

WithClientAssertionJWT sets the `client_assertion` param in the token request

WithCodeChallenge sets the `code_challenge` params in the auth request

WithCodeVerifier sets the `code_verifier` param in the token request

WithCustomEndpoints sets multiple endpoints at once. None of the endpoints may be nil, or an error will be returned when the Option used by the Provid

WithDecoder overrides the default decoder, which is a [schema.Decoder] with IgnoreUnknownKeys set to true.

WithFallbackLogger is retained for source compatibility. Deprecated: use [slog.SetDefault]. This option has no effect.

WithHTTPClient provides the ability to set an http client to be used for the relaying party and verifier

WithHTTPMiddleware sets the passed middleware chain to the root of the Server's router.

WithIDTokenHintKeySet allows passing a KeySet with public keys for ID Token Hint verification. The default KeySet uses the [Storage] interface.

WithIssuedAtMaxAge provides the ability to define the maximum duration between iat and now

WithIssuerFromCustomHeaders can be used to customize the header names used. The same rules apply where the first successful host is returned.

WithLogger sets the logger returned by [RelyingParty.Logger]. OIDC package logging uses the global [slog] default; prefer [slog.SetDefault]. Deprecate

WithLogger is retained for source compatibility. Deprecated: use [slog.SetDefault]. This option has no effect.

WithReturnParentToClient allows returning the set parent error to the HTTP client. Currently, it only supports setting the parent inside JSON response

WithSetRouter allows customization or the Server's router.

WithStaticEndpoints provides the ability to set static token and introspect URL

createTokens delegates token creation to the appropriate storage method based on the request type and requirements. It returns an access token ID and

done can only be called by a single goroutine. It records the result of the inflight request and signals other goroutines that the result is safe to i

getInfoFromRequest returns the clientID, authTime and amr depending on the op.TokenRequest type / implementation

handleFormPostResponse processes the authentication response using form post method

handleRedirectResponse processes the authentication response using the redirect method

keysFromRemote syncs the key set from the remote set, records the values in the cache, and returns the key set.

newDynamicOP will create an OpenID Provider for localhost on a specified port with a given encryption key and a predefined default logout uri it will

newOP will create an OpenID Provider for localhost on a specified port and a predefined default logout uri it will enable all options (see description

renewRefreshToken checks the provided refresh_token and creates a new one based on the current [Refresh Token Rotation] is implemented. [Refresh Tok

requestLoggingMiddleware demonstrates request IDs and structured incoming request logs using only the standard library.

result cannot be called until the wait() channel has returned a value.

rsaPublicKeyOfBits builds a public key of an exact size, avoiding slow keygen.

TODO(v4): Use the new jose.SignatureAlgorithm type directly, instead of string.

ValidateAuthReqRedirectURINative validates the passed redirect_uri and response_type to the registered uris and client type

verifyDeviceKeyBinding checks that the ID Token returned by the device token endpoint is actually bound to the expected RP's key.

verifySignatureCached checks for a matching key in the cached key list if there is only one possible, it tries to verify the signature and will retur

wait returns a channel that multiple goroutines can receive on. Once it returns a value, the inflight request is done and result() can be inspected.

ACRVerify is a oidc.ACRVerifier func.

AccessTokenType must return the type of access token the client uses (Bearer (opaque) or JWT)

AccessTokenType mocks base method.