OAuth.jl

OAuth.jl is a reference implementation of modern OAuth 2.x client/server flows in Julia. It now includes:

PAR/JAR support with automatic HTTPS validation and request-object signing via RequestObjectSigner.
Resource Indicator (RFC 8707) and Rich Authorization Request (RFC 9396) propagation for PKCE, refresh tokens, device authorization, and client credentials.
Dynamic Client Registration helpers for RFC 7591/7592 compliant authorization servers.

Quick Links

OAuth.PublicClientConfig — Type

PublicClientConfig

Configuration for apps that cannot keep a secret (CLIs, native apps, SPAs). Along with identifiers and scopes it stores optional DPoP credentials, refresh token persistence hooks, and whether to prefer pushed authorization requests or signed request objects.

source

OAuth.RequestObjectSigner — Type

RequestObjectSigner

Encapsulates the inputs required to sign JWT request objects (PAR or direct request parameter). Created through the keyword constructor that accepts private keys, algorithm selections, optional kid, and any extra claims to embed.

source

OAuth.register_dynamic_client — Function

register_dynamic_client(metadata, client_metadata; http=HTTP, initial_access_token=nothing, verbose=false) -> JSONObject

Calls the Dynamic Client Registration endpoint declared in issuer metadata and returns the resulting JSON document (which typically holds client_secret, registration_access_token, etc.). Pass initial_access_token when the AS protects its registration endpoint.

source

OAuth.register_dynamic_client_from_issuer — Function

register_dynamic_client_from_issuer(issuer_url, client_metadata; kwargs...) -> NamedTuple

Fetches metadata for the issuer and forwards the request to register_dynamic_client. Returns both the JSON response and the metadata used.

source

OAuth.update_dynamic_client — Function

update_dynamic_client(configuration_endpoint; http=HTTP, client_metadata, registration_access_token, verbose=false) -> JSONObject

Issues a PUT request to the client configuration endpoint with the supplied metadata body. Requires the registration_access_token obtained during registration.

source

OAuth.delete_dynamic_client — Function

delete_dynamic_client(configuration_endpoint; http=HTTP, registration_access_token, verbose=false) -> Bool

Sends a DELETE to the client configuration endpoint, authenticating with the provided registration_access_token. Returns true on HTTP 2xx.

source