tokens

Token lifecycle after login: refresh a verified session (same sub, same checks as the original exchange) and best-effort revocation. Code exchange lives in atproto/oauth/flow.callback, behind the state and iss checks. A thin sync wrapper over atproto_core/oauth/tokens.

Types

TokenError

pub type TokenError =
  session.TokenError

VerifiedSession

pub type VerifiedSession =
  session.VerifiedSession

Values

refresh

pub fn refresh(
  client: xrpc.Client,
  session session: session.VerifiedSession,
  dpop_key dpop_key: gose.Key(String),
  client_auth client_auth: transport.ClientAuth,
) -> Result(session.VerifiedSession, session.TokenError)

revoke

pub fn revoke(
  client: xrpc.Client,
  session session: session.VerifiedSession,
  dpop_key dpop_key: gose.Key(String),
  client_auth client_auth: transport.ClientAuth,
) -> Nil

Best-effort revocation at logout. Failures are ignored (the caller clears its local session regardless).

token_error_to_string

pub fn token_error_to_string(error: session.TokenError) -> String