client

Jun 9, 2026

Changes in this version

+ const DeviceCodeGrantType

+ var ErrAccessDenied = errors.New("RFC 8628 access_denied")

+ var ErrAuthorizationPending = errors.New("RFC 8628 authorization_pending")

+ var ErrExpiredToken = errors.New("RFC 8628 expired_token")

+ var ErrSlowDown = errors.New("RFC 8628 slow_down")

type ASMetadata

+ DeviceAuthorizationEndpoint string

type AuthClient

+ func (c *AuthClient) DeviceAuthorization(ctx context.Context, req *DeviceAuthorizationRequest) (*DeviceAuthorizationResponse, error)

+ func (c *AuthClient) PollDeviceToken(ctx context.Context, req *PollDeviceTokenRequest) (*ServerCredential, error)

+ type DeviceAuthorizationRequest struct

+ Audience string

+ ClientID string

+ ClientSecret string

+ Scopes []string

+ type DeviceAuthorizationResponse struct

+ DeviceCode string

+ ExpiresIn int64

+ Interval int

+ UserCode string

+ VerificationURI string

+ VerificationURIComplete string

+ type PollDeviceTokenRequest struct

+ ClientID string

+ ClientSecret string

+ DeviceCode string

Jun 8, 2026

Changes in this version

type LoginRequest

+ ClientSecret string

Jun 8, 2026

Changes in this version

type AuthClient

+ func (c *AuthClient) RefreshToken(ctx context.Context, req *RefreshTokenRequest) (*ServerCredential, error)

+ type RefreshTokenRequest struct

+ ClientID string

+ ClientSecret string

+ RefreshToken string

+ Scopes []string

Jun 8, 2026

Changes in this version

type ASMetadata

+ func DiscoverASWithContext(ctx context.Context, issuerURL string, opts ...DiscoveryOption) (*ASMetadata, error)

May 31, 2026

Changes in this version

+ var ErrIssMismatch = errors.New("RFC 9207 iss does not match authorization server issuer")

+ var ErrIssMissing = errors.New("RFC 9207 iss missing from authorization response")

+ func ValidateIss(iss, expectedIssuer string, asAdvertisedSupport, strict bool) error

May 31, 2026

Changes in this version

type ASMetadata

+ AuthorizationResponseIssParameterSupported *bool

May 30, 2026

Changes in this version

+ var ErrMetadataIssuerMismatch = errors.New("AS metadata issuer does not match discovery URL")

type BrowserLoginRequest

+ OnCallback func(ctx context.Context, params CallbackParams) error

+ type CallbackParams struct

+ Code string

+ Iss string

+ State string

May 27, 2026

Changes in this version

+ type BrowserLoginRequest struct

+ AuthorizationEndpoint string

+ CallbackPort int

+ ClientAssertion *ClientAssertionConfig

+ ClientID string

+ ClientSecret string

+ HTTPClient *http.Client

+ OpenBrowser func(url string) error

+ Resource string

+ Scopes []string

+ Timeout time.Duration

+ TokenEndpoint string

+ TokenEndpointAuthMethods []string

+ type LoginRequest struct

+ ClientID string

+ Password string

+ Scope string

+ Username string

May 26, 2026

Changes in this version

+ const JwtBearerGrantType

+ const TokenExchangeGrantType

type AuthClient

+ func (c *AuthClient) JwtBearerGrant(req *JwtBearerGrantRequest) (*ServerCredential, error)

+ func (c *AuthClient) TokenExchange(req *TokenExchangeRequest) (*TokenExchangeResponse, error)

+ type JwtBearerGrantRequest struct

+ Assertion string

+ ClientAssertion *ClientAssertionConfig

+ ClientID string

+ ClientSecret string

+ Resources []string

+ Scope []string

+ type TokenExchangeRequest struct

+ ActorToken string

+ ActorTokenType string

+ Audience []string

+ ClientAssertion *ClientAssertionConfig

+ ClientID string

+ ClientSecret string

+ RequestedTokenType string

+ Resource []string

+ Scope []string

+ SubjectToken string

+ SubjectTokenType string

+ type TokenExchangeResponse struct

+ AccessToken string

+ ExpiresIn int

+ IssuedTokenType string

+ RefreshToken string

+ Scope []string

+ TokenType string

May 26, 2026

Changes in this version

type AuthClient

+ func (c *AuthClient) ClientCredentials(req *ClientCredentialsRequest) (*ServerCredential, error)

+ type ClientCredentialsRequest struct

+ AuthorizationDetails []core.AuthorizationDetail

+ ClientAssertion *ClientAssertionConfig

+ ClientID string

+ ClientSecret string

+ Resources []string

+ Scopes []string

type ClientCredentialsSource

+ Resources []string

May 26, 2026

Changes in this version

type ClientAssertionConfig

+ Audience string

type ClientCredentialsSource

+ ClientAssertion *ClientAssertionConfig

May 24, 2026

Changes in this version

type ClientRegistrationRequest

+ ApplicationType string

May 19, 2026

Changes in this version

+ const DefaultClientAssertionLifetime

+ func MintClientAssertion(clientID, audience string, cfg ClientAssertionConfig) (string, error)

type ASMetadata

+ TokenEndpointAuthSigningAlgValuesSupported []string

type AuthClient

+ func (c *AuthClient) ClientCredentialsTokenWithAssertion(clientID string, cfg ClientAssertionConfig, scopes []string) (*ServerCredential, error)

type BrowserLoginConfig

+ ClientAssertion *ClientAssertionConfig

+ type ClientAssertionConfig struct

+ KeyID string

+ Lifetime time.Duration

+ PrivateKey crypto.PrivateKey

+ SigningAlg string

type TokenEndpointAuthMethod

+ const AuthMethodPrivateKeyJWT

May 7, 2026

Changes in this version

+ var ErrRegistrationUnauthorized = fmt.Errorf("registration management: unauthorized")

type ClientRegistrationRequest

+ ClientID string

+ ClientURI string

+ Scope string

type ClientRegistrationResponse

+ ClientIDIssuedAt int64

+ ClientName string

+ ClientSecretExpiresAt int64

+ ClientURI string

+ GrantTypes []string

+ RedirectURIs []string

+ RegistrationAccessToken string

+ RegistrationClientURI string

+ Scope string

+ TokenEndpointAuthMethod string

+ type DeleteRegistrationRequest struct

+ HTTPClient *http.Client

+ RegistrationAccessToken string

+ RegistrationClientURI string

+ type DeleteRegistrationResponse struct

+ func DeleteRegistration(ctx context.Context, req *DeleteRegistrationRequest) (*DeleteRegistrationResponse, error)

+ type GetRegistrationRequest struct

+ HTTPClient *http.Client

+ RegistrationAccessToken string

+ RegistrationClientURI string

+ type GetRegistrationResponse struct

+ Registration *ClientRegistrationResponse

+ func GetRegistration(ctx context.Context, req *GetRegistrationRequest) (*GetRegistrationResponse, error)

+ type UpdateRegistrationRequest struct

+ ClientID string

+ HTTPClient *http.Client

+ Metadata ClientRegistrationRequest

+ RegistrationAccessToken string

+ RegistrationClientURI string

+ type UpdateRegistrationResponse struct

+ Registration *ClientRegistrationResponse

+ func UpdateRegistration(ctx context.Context, req *UpdateRegistrationRequest) (*UpdateRegistrationResponse, error)

Apr 27, 2026

Changes in this version

type ClientCredentialsSource

+ AuthorizationDetails []core.AuthorizationDetail

type OAuth2TokenResponse

+ AuthorizationDetails []any

type ServerCredential

+ AuthorizationDetails []core.AuthorizationDetail

Apr 11, 2026

Changes in this version

type AuthClient

+ OnToken func(*ServerCredential)

type ClientCredentialsSource

+ OnToken func(*ServerCredential)

Apr 10, 2026

Changes in this version

+ const DefaultASCacheTTL

+ type ASMetadataStore interface

+ Get func(issuer string) (*ASMetadata, bool)

+ Put func(issuer string, md *ASMetadata, ttl time.Duration)

type ClientCredentialsSource

+ Refresher *ProactiveRefresher

+ func (s *ClientCredentialsSource) Close() error

type DiscoveryOption

+ func WithASCacheTTL(ttl time.Duration) DiscoveryOption

+ func WithASMetadataStore(store ASMetadataStore) DiscoveryOption

+ type MemoryASMetadataStore struct

+ func NewMemoryASMetadataStore(defaultTTL time.Duration) *MemoryASMetadataStore

+ func (s *MemoryASMetadataStore) Get(issuer string) (*ASMetadata, bool)

+ func (s *MemoryASMetadataStore) Put(issuer string, md *ASMetadata, ttl time.Duration)

+ type ProactiveRefresher struct

+ Buffer time.Duration

Apr 9, 2026

Changes in this version

+ func IsLocalhost(rawURL string) bool

+ func ValidateCIMDURL(rawURL string) error

+ func ValidateHTTPS(meta *ASMetadata) error

+ type ClientCredentialsSource struct

+ Audience string

+ ClientID string

+ ClientSecret string

+ Scopes []string

+ TokenEndpoint string

+ func (s *ClientCredentialsSource) Token() (string, error)

+ func (s *ClientCredentialsSource) TokenForScopes(scopes []string) (string, error)

+ type ClientRegistrationRequest struct

+ ClientName string

+ GrantTypes []string

+ RedirectURIs []string

+ ResponseTypes []string

+ TokenEndpointAuthMethod string

+ type ClientRegistrationResponse struct

+ ClientID string

+ ClientSecret string

+ func RegisterClient(endpoint string, meta ClientRegistrationRequest, httpClient *http.Client) (*ClientRegistrationResponse, error)

+ type ScopeAwareTokenSource interface

+ TokenForScopes func(scopes []string) (string, error)

+ type TokenSource interface

+ Token func() (string, error)

Apr 7, 2026

Changes in this version

type BrowserLoginConfig

+ TokenEndpointAuthMethods []string

Apr 7, 2026

Changes in this version

+ func FollowRedirects(httpClient *http.Client) func(string) error

type BrowserLoginConfig

+ ClientSecret string

type ClientOption

+ func WithASMetadata(meta *ASMetadata) ClientOption

+ type TokenEndpointAuthMethod string

+ const AuthMethodClientSecretBasic

+ const AuthMethodClientSecretPost

+ const AuthMethodNone

+ func SelectAuthMethod(clientSecret string, asMethods []string) TokenEndpointAuthMethod

Apr 6, 2026

Changes in this version

type BrowserLoginConfig

+ Resource string

Apr 5, 2026

Changes in this version

+ type ASMetadata struct

+ AuthorizationEndpoint string

+ CodeChallengeMethodsSupported []string

+ GrantTypesSupported []string

+ IntrospectionEndpoint string

+ Issuer string

+ JWKSURI string

+ RegistrationEndpoint string

+ ResponseTypesSupported []string

+ RevocationEndpoint string

+ ScopesSupported []string

+ TokenEndpoint string

+ TokenEndpointAuthMethods []string

+ UserinfoEndpoint string

+ func DiscoverAS(issuerURL string, opts ...DiscoveryOption) (*ASMetadata, error)

type AuthClient

+ func (c *AuthClient) ClientCredentialsToken(clientID, clientSecret string, scopes []string) (*ServerCredential, error)

+ func (c *AuthClient) LoginWithBrowser(cfg BrowserLoginConfig) (*ServerCredential, error)

+ type BrowserLoginConfig struct

+ AuthorizationEndpoint string

+ CallbackPort int

+ ClientID string

+ HTTPClient *http.Client

+ OpenBrowser func(url string) error

+ Scopes []string

+ Timeout time.Duration

+ TokenEndpoint string

+ type DiscoveryOption func(*discoveryConfig)

+ func WithHTTPClientForDiscovery(client *http.Client) DiscoveryOption

type OAuth2TokenRequest

+ ClientSecret string

+ Code string

+ CodeVerifier string

+ RedirectURI string

Jan 13, 2026

Changes in this version

+ const RefreshThreshold

+ type AuthClient struct

+ func NewAuthClient(serverURL string, store CredentialStore, opts ...ClientOption) *AuthClient

+ func (c *AuthClient) GetCredential() (*ServerCredential, error)

+ func (c *AuthClient) GetToken() (string, error)

+ func (c *AuthClient) HTTPClient() *http.Client

+ func (c *AuthClient) IsLoggedIn() bool

+ func (c *AuthClient) Login(username, password, scope string) (*ServerCredential, error)

+ func (c *AuthClient) Logout() error

+ func (c *AuthClient) ServerURL() string

+ type AuthTransport struct

+ Base http.RoundTripper

+ Token string

+ func NewAuthTransport(token string) *AuthTransport

+ func NewAuthTransportWithBase(base http.RoundTripper, token string) *AuthTransport

+ func (t *AuthTransport) RoundTrip(req *http.Request) (*http.Response, error)

+ type ClientOption func(*AuthClient)

+ func WithHTTPClient(client *http.Client) ClientOption

+ func WithTokenEndpoint(path string) ClientOption

+ func WithTransport(transport http.RoundTripper) ClientOption

+ type CredentialStore interface

+ GetCredential func(serverURL string) (*ServerCredential, error)

+ ListServers func() ([]string, error)

+ RemoveCredential func(serverURL string) error

+ Save func() error

+ SetCredential func(serverURL string, cred *ServerCredential) error

+ type OAuth2TokenRequest struct

+ ClientID string

+ GrantType string

+ Password string

+ RefreshToken string

+ Scope string

+ Username string

+ type OAuth2TokenResponse struct

+ AccessToken string

+ Error string

+ ErrorDesc string

+ ExpiresIn int64

+ RefreshToken string

+ Scope string

+ TokenType string

+ type ServerCredential struct

+ AccessToken string

+ CreatedAt time.Time

+ ExpiresAt time.Time

+ RefreshToken string

+ Scope string

+ TokenType string

+ UserEmail string

+ UserID string

+ func (c *ServerCredential) HasRefreshToken() bool

+ func (c *ServerCredential) IsExpired() bool

+ func (c *ServerCredential) IsExpiringSoon(within time.Duration) bool