clientauth

Oct 7, 2026

Changes in this version

type Connection

+ ServerCAFile string

Sep 10, 2026

Changes in this version

+ func OpenCredentialStore(ctx context.Context, root string, backend CredentialBackend) (credentialstore.Store, error) — darwin/amd64, linux/amd64

+ type CredentialBackend string — darwin/amd64, linux/amd64

+ const CredentialBackendFile

+ const CredentialBackendKeyring

+ func OpenExistingCredentialStore(ctx context.Context, root string) (credentialstore.Store, CredentialBackend, error)

+ type CredentialStoreMode string — darwin/amd64, linux/amd64

+ const CredentialStoreAuto

+ const CredentialStoreFile

+ const CredentialStoreKeyring

+ type CredentialStoreSelection struct — darwin/amd64, linux/amd64

+ Backend CredentialBackend

+ NewlyPinned bool

+ func ResolveCredentialStore(ctx context.Context, root string, requested CredentialStoreMode) (CredentialStoreSelection, error)

Sep 8, 2026

Changes in this version

type Connection

+ ResourceURL string

type Registry

+ func (r *Registry) Find(alias string) (Connection, error)

Sep 2, 2026

Changes in this version

+ func IssuerHTTPClient(ctx context.Context, policy IssuerAddressPolicy, issuer string, ...) (*http.Client, error)

type Connection

+ IssuerAddressPolicy IssuerAddressPolicy

+ type IssuerAddressPolicy string

+ const IssuerAddressPolicyPrivate

+ const IssuerAddressPolicyPublic

type LoginConfig

+ IssuerAddressPolicy IssuerAddressPolicy

type LogoutConfig

+ HTTPClientForConnection func(context.Context, Connection) (*http.Client, bool, error)

Sep 1, 2026

Changes in this version

+ var ErrAuthorization = errors.New("clientauth: authorization failed")

+ var ErrCorrupt = errors.New("clientauth: corrupt credential")

+ var ErrCredentialCleanup = errors.New("clientauth: credential cleanup failed")

+ var ErrDiscovery = errors.New("clientauth: OIDC discovery rejected")

+ var ErrIncompleteEnrollment = errors.New("clientauth: enrollment incomplete")

+ var ErrIncompleteLogout = errors.New("clientauth: logout incomplete")

+ var ErrInvalidIdentity = errors.New("clientauth: invalid target identity")

+ var ErrKeyUnavailable = errors.New("clientauth: encryption key unavailable")

+ var ErrLoginRequired = errors.New("clientauth: login required")

+ var ErrTargetChanged = errors.New("clientauth: target changed during sign-in")

+ var ErrTokenExchange = errors.New("clientauth: token exchange failed")

+ func Enroll(ctx context.Context, conn Connection, token Token, cfg EnrollmentConfig) error

+ func IsNotEnrolled(err error) bool

+ func OpenExistingStore(ctx context.Context, root string, keys ExistingKeyProvider) (*credentialstore.EncryptedFileStore, error)

+ func OpenStore(ctx context.Context, root string, keys KeyProvider) (*credentialstore.EncryptedFileStore, error)

+ type Connection struct

+ Identity Identity

+ IssuerCAFile string

+ func (c *Connection) UnmarshalJSON(data []byte) error

+ type CredentialRecord struct

+ Token Token

+ Version credentialstore.Version

+ type Credentials struct

+ func NewCredentials(store credentialstore.Store) (*Credentials, error)

+ func (c *Credentials) Delete(ctx context.Context, identity Identity, expected credentialstore.Version) error

+ func (c *Credentials) Load(ctx context.Context, identity Identity) (CredentialRecord, error)

+ func (c *Credentials) Save(ctx context.Context, identity Identity, token Token, ...) (CredentialRecord, error)

+ func (c *Credentials) Upsert(ctx context.Context, identity Identity, token Token) (CredentialRecord, error)

+ type EnrollmentConfig struct

+ Credentials *Credentials

+ ExpectedCredential *ExpectedCredentialState

+ ExpectedTarget *[]Connection

+ Registry *Registry

+ type ExistingKeyProvider interface

+ ExistingStoreKey func(context.Context) ([]byte, error)

+ type ExpectedCredentialState struct

+ Corrupt bool

+ Found bool

+ Version credentialstore.Version

+ type Identity struct

+ Audience string

+ ClientID string

+ Issuer string

+ RedirectURI string

+ Scopes []string

+ Target string

+ func (i Identity) Canonical() (Identity, error)

+ func (i Identity) Equal(other Identity) bool

+ type IncompleteLogoutError struct

+ func (*IncompleteLogoutError) Error() string

+ func (*IncompleteLogoutError) Unwrap() error

+ type KeyProvider interface

+ StoreKey func(context.Context) ([]byte, error)

+ type KeyringProvider struct

+ func NewExistingKeyringProvider(root string) (*KeyringProvider, error)

+ func NewKeyringProvider(root string) (*KeyringProvider, error)

+ func (p *KeyringProvider) ExistingStoreKey(ctx context.Context) ([]byte, error)

+ func (p *KeyringProvider) StoreKey(ctx context.Context) ([]byte, error)

+ type LoginConfig struct

+ HTTPClient *http.Client

+ Identity Identity

+ Presenter Presenter

+ PrivateHTTPS bool

+ Registry *Registry

+ TrustedCAFile string

+ TrustedCAPEM []byte

+ type LoginRequiredCause string

+ const CredentialUnusable

+ const NotEnrolled

+ const SessionExpired

+ type LoginRequiredError struct

+ Cause LoginRequiredCause

+ func (*LoginRequiredError) Unwrap() error

+ func (e *LoginRequiredError) Error() string

+ type LogoutConfig struct

+ Credentials *Credentials

+ HTTPClient func(context.Context, []Connection) (*http.Client, error)

+ HTTPClientOwned func(context.Context, []Connection) (*http.Client, bool, error)

+ Registry *Registry

+ type LogoutIssue struct

+ Identity Identity

+ Stage string

+ type LogoutResult struct

+ CredentialsDeleted int

+ CredentialsMissing int

+ Entries int

+ Issues []LogoutIssue

+ RegistryDeleted bool

+ RevocationError string

+ RevocationsAttempted int

+ RevocationsFailed int

+ Target string

+ func Logout(ctx context.Context, target string, cfg LogoutConfig) (LogoutResult, error)

+ type Presenter interface

+ Present func(context.Context, string) (oauthlogin.Result, error)

+ type PresenterFunc func(context.Context, string) (oauthlogin.Result, error)

+ func (f PresenterFunc) Present(ctx context.Context, u string) (oauthlogin.Result, error)

+ type RefreshSource struct

+ func NewRefreshSource(ctx context.Context, creds *Credentials, cfg LoginConfig) (*RefreshSource, error)

+ func (s *RefreshSource) Close() error

+ func (s *RefreshSource) Token(ctx context.Context) (string, error)

+ type Registry struct

+ func OpenExistingRegistry(root string) (*Registry, error)

+ func OpenRegistry(root string) (*Registry, error)

+ func (r *Registry) DeleteTarget(target string, expected []Connection) (int, error)

+ func (r *Registry) FindTarget(target string) (Connection, error)

+ func (r *Registry) List() ([]Connection, error)

+ func (r *Registry) Upsert(conn Connection) ([]Identity, error)

+ type Token struct

+ AccessToken string

+ Expiry string

+ RefreshToken string

+ TokenType string

+ func Login(ctx context.Context, cfg LoginConfig) (Token, error)