authentication_go

Package api_key_cruder reads and writes the keys an account registers, and records what they mint with.

Package assertion verifies what a client signs to mint a token: a short-lived JWT, signed by the private half of a key the account registered, saying which key is asking and what it is asking of.

Package client is the holder's side of an API key: the assertion it signs with the private half of a key its account registered, wherever that half is kept -- a file, a key manager, a TPM, anything a crypto.Signer reaches -- and the exchange of the assertion for a session token at the login service's token endpoint.

Package create_api_key_endpoint registers a public key for the signed-in account.

Package mint_token_endpoint mints an access token for a client that can sign for a registered key.

Package read_own_api_keys_endpoint lists the keys the signed-in account registered.

Package revoke_api_key_endpoint takes one of the account's keys out of use.

Package public_key reads the public keys accounts register for API access.

Package testing is what the API key packages' tests share: a database of a test package's own, on the server TEST_DATABASE_URL names, with the library's tables in it; accounts in it; and session tokens for them, signed by a key the tests hold, as a browser or a minted token would carry them.

Package types holds what the API key endpoints take and answer with.

Package api_key holds the public keys an account registers to mint tokens with.

Package api_key_assertion remembers the assertions a key has already minted with, for as long as they could still be presented again.

Package api_key_authentication links a sign-in to the key that minted it.

Package oauth_authorization is what the OAuth authorization server keeps, as tables.

Package dpop holds what the parts of DPoP (RFC 9449) share: the names it puts on the wire, the challenges a refusal answers with, and the hash by which a proof names the token it is sent with.

Package testing makes the keys and proofs that tests of DPoP need.

Package memory_replay_detector remembers the DPoP proofs a process has accepted, for as long as each could still be accepted, so that a second presentation of one is refused.

Package proof_key reads the public key a DPoP proof carries in its "jwk" header.

Package proof_verifier checks a DPoP proof (RFC 9449 §4.3): that it was made, just now, for this request, by the key the token it comes with is bound to.

Package proof_verifier_config sets how a DPoP proof is verified: how old it may be, how far the client's clock may be off, and whether the proofs accepted are remembered so that none is accepted twice.

Package token_extractor reads an access token from "Authorization: DPoP" and, unless told otherwise, "Authorization: Bearer", and says which of the two it came under.

Package log_masking keeps the credentials the authentication endpoints handle out of the log, by telling the log's HTTP context extractor where they are.

Package testing holds what the tests of the endpoints' logging share.

Package oauth is an OAuth 2.1 authorization server for the resources of the apps a sign-in service fronts -- an app's MCP server, say -- beside the service's own sessions rather than in place of them.

Package testing holds what tests of the OAuth authorization server share: the behaviour every store must have, as a test any of them can be run through.

Package access_token is an OAuth access token as the authorization server issues it: a JWT (RFC 9068) for one resource, signed with a key of its own.

Package access_token_parser is how a resource accepts the authorization server's access tokens: a request parser that takes a bearer token only of the server's type, signed with its key, for this resource and with the scope the resource requires.

Package cimd_fetcher reads a client's metadata document (Client ID Metadata Documents, as the MCP authorization specification has clients register): a client's id is the HTTPS URL of a JSON document saying what the client is called and where it may be sent back to, which the authorization server fetches when the client first asks for authorization.

Package client is an OAuth client as the authorization server knows it: what it is called and where it may be sent back to.

Package client_registrar is dynamic client registration (RFC 7591) without a store: a client's id is what it registered, signed, and resolving it is checking the signature and reading it back.

Package client_resolver is how the authorization server knows a client: one registered with it beforehand, one that registered itself and holds the id it was given, or one whose id is the URL of a metadata document on a host it allows.

Package authorization_server_metadata_endpoint serves the authorization server's metadata (RFC 8414), which is how a client learns where to send the user and where to redeem a code, and what the server supports -- among it that a client may register by its metadata document, which is what has Claude use one rather than register dynamically.

Package authorize_endpoint is the authorization endpoint (RFC 6749 section 3.1, OAuth 2.1): where a client sends the user to be asked whether it may act for them on a resource.

Package decision_endpoint takes the user's answer to the consent page: on allowing, an authorization code for the client; on denying, the refusal.

Package protected_resource_metadata_endpoint serves a resource's metadata (RFC 9728), which is how a client that was refused by the resource learns which authorization server to ask, and for what scope.

Package registration_endpoint is the client registration endpoint (RFC 7591): where a client with no metadata document of its own -- Gemini's -- registers, and is given an id.

Package revocation_endpoint is the revocation endpoint (RFC 7009): where a client gives up what it was granted, as Claude does when the user removes a connector.

Package token_endpoint is the token endpoint (RFC 6749 section 3.2, OAuth 2.1): where a client redeems an authorization code, or a refresh token, for an access token to a resource.

Package memory_store keeps what the OAuth authorization server hands out in memory, for tests: nothing expired is ever swept, so a server kept running on it would grow without end.

Package page is the authorization server's pages: the consent page, and the message a request is refused with where it cannot be sent back to its client.

Package postgres_store keeps what the OAuth authorization server hands out in the tables of database/types/oauth_authorization, alongside the service's accounts.

Package pkce checks a Proof Key for Code Exchange (RFC 7636), which ties a one-time code to the party that asked for it: the client sends a hash of a secret when it starts, and the secret itself when it redeems the code, so that a code intercepted on its way back -- by another app claiming the same URI scheme, say -- is worth nothing to whoever intercepted it.

Package active_session_processor checks, against the database, that a session token an authorizer has accepted may still be acted on.

Package authentication_method names how a session's holder proved who they are, as the "amr" claim carries it.

Package navigation_refresh_handler renews an expired session on a navigation to a sign-in page and sends the browser back where it came from, instead of asking someone to sign in again while their authentication is still valid.

Package session_instructions holds the session instructions a server returns to a browser for a device bound session.

Package login_endpoint starts the authorization code flow: it mints the state and the PKCE code verifier, records them as an oauth flow, and redirects the user to the provider.