tokens

Token endpoint calls: exchange an authorization code for DPoP-bound tokens, refresh them with the rotating refresh token, and best-effort revocation. Confidential clients pass client-assertion fields via extra_form. A thin sync wrapper over the effect kernel in atproto/oauth/core/tokens; the Tokens type is re-exported from there.

Types

Tokens

pub type Tokens =
  tokens.Tokens

Values

exchange_code

pub fn exchange_code(
  client: xrpc.Client,
  flow flow: flow.Flow,
  code code: String,
  redirect_uri redirect_uri: String,
  extra_form extra_form: List(#(String, String)),
) -> Result(tokens.Tokens, String)

refresh

pub fn refresh(
  client: xrpc.Client,
  token_endpoint token_endpoint: String,
  refresh_token refresh_token: String,
  client_id client_id: String,
  dpop_key dpop_key: gose.Key(String),
  extra_form extra_form: List(#(String, String)),
) -> Result(tokens.Tokens, String)

revoke

pub fn revoke(
  client: xrpc.Client,
  issuer issuer: String,
  refresh_token refresh_token: String,
  client_id client_id: String,
  dpop_key dpop_key: gose.Key(String),
  extra_form extra_form: List(#(String, String)),
) -> Nil

Best-effort refresh-token revocation at logout: discover the AS revocation endpoint from the issuer and revoke. Failures are ignored (the caller clears its local session regardless).