Module authorize 

OAuth 2.0 and OpenID Connect implementation.

This module implements the following RFCs and specifications:

OAuth 2.0 Core

• RFC 6749 — OAuth 2.0 Authorization Framework
  • §3.1 — Authorization Endpoint (/authorize)
  • §3.2 — Token Endpoint (/token)

OAuth 2.0 Extensions

• RFC 7009 — OAuth 2.0 Token Revocation (/revoke)
• RFC 7636 — Proof Key for Code Exchange (PKCE)
• RFC 7662 — OAuth 2.0 Token Introspection (/introspect)
• RFC 8414 — OAuth 2.0 Authorization Server Metadata (/.well-known/openid-configuration)
• RFC 9449 — OAuth 2.0 Demonstrating Proof-of-Possession (DPoP)

JSON Web Token (JWT)

• RFC 7517 — JSON Web Key (JWK) (/jwks.json)

OpenID Connect

• OpenID Connect Core 1.0
  • §3 — Authorization Endpoint (/authorize)
  • §3.1.3 — Token Endpoint (/token)
  • §5.3 — UserInfo Endpoint (/userinfo)
  • §10 — JWKS endpoint for key discovery (/jwks.json) — Note: Currently exposes a single key; key rotation not implemented
• OpenID Connect Discovery 1.0 (/.well-known/openid-configuration)

Structs

MainFrontendOauthAuthorizeApiDoc 🔒

PromptFlags 🔒

Functions

_add_routes

anonymous_response 🔒

The answer to an authorization request without a signed-in user: login_required for prompt=none, else the login page. The error is redirected to error_redirect, which must be a verified redirect URI of the client.

authorize

Handles the /authorize endpoint for OAuth 2.0 and OpenID Connect with PKCE support.

authorize_get_doc 🔒

authorize_post_doc 🔒

check_resource 🔒

Enforces RFC 8707 resource indicators for the MCP server: its scopes need its URL as resource, and it takes tokens only for metadata document clients.

parse_prompt 🔒

respond_to_authorize 🔒