oauth2

OAuth2 client for the Authorization Code grant with PKCE (RFC 6749 + RFC 7636) — the recommended flow for both server-side and public clients. Builds the provider authorize URL (with CSRF state and a PKCE code_verifier/code_challenge), exchanges an authorization code for tokens, and refreshes them.

Authorization code pkce

import tinox.core.oauth2;

class Main
{
    fnc main() -> Int32
    {
        let client: OAuth2Client = OAuth2Client::new(
            "https://accounts.google.com/o/oauth2/v2/auth",
            "https://oauth2.googleapis.com/token",
            "my-client-id",
            "my-client-secret",
            "https://myapp.example.com/callback"
        );

        // Step 1: redirect the user-agent to req.url, store req.state +
        // req.codeVerifier in the session (needed again at the callback).
        let req: OAuth2AuthorizeRequest = client.buildAuthorizeUrl("openid email");
        println("redirect user to: " + req.url);

        // Step 2: in the callback handler, after checking req.state against
        // the callback's "state" query param:
        let tokens: OAuth2TokenResponse = client.exchangeCode("the-code-from-callback", req.codeVerifier);
        if tokens.ok
        {
            println("access token: " + tokens.accessToken);
        }
        else
        {
            println("login failed: " + tokens.errorMessage);
        }
        return 0;
    }
}

class OAuth2AuthorizeRequest

Fields

class OAuth2Client

Fields

Methods

class OAuth2TokenResponse

Fields