resource

DPoP-authenticated resource requests: wraps a transport so every request carries Authorization: DPoP <token> and a proof bound to its method, URL, and access-token hash, with the server-nonce retry. The token is only sent to the session’s PDS origin; any other request fails with TransportError.Other and nothing is sent. Token refresh is the caller’s job (it owns session persistence); this module only signs.

A thin sync wrapper over the effect kernel in atproto_core/oauth/resource: it computes the access-token hash (ath) once and runs the per-request signing effect against the base client.

Values

client

pub fn client(
  base: xrpc.Client,
  session session: session.VerifiedSession,
  dpop_key dpop_key: gose.Key(String),
) -> xrpc.Client

A client that signs every request to the session’s PDS with its DPoP-bound access token.