Skip to main content Module oauth Copy item path Source GetAuthorizationQuery 🔒 GET /xrpc/bot.did.getAuthorization’s query parameters.Issued 🔒 What issue_approval ListPendingAuthorizationsQuery 🔒 GET /xrpc/bot.did.listPendingAuthorizations’s query parameters.OAuthAuthorizeQuery 🔒 GET /oauth/authorize’s query parameters.OAuthBrowserQuery 🔒 GET /oauth/browser’s query parameters.OAuthParForm 🔒 The wire fields POST /oauth/par accepts, form-encoded per RFC 9126. OAuthTokenForm 🔒 The wire fields POST /oauth/token accepts, form-encoded per RFC 6749
§4. Refused 🔒 An OAuth refusal on its way out: what the client is sent, and how the
journal says it. See crate::refusal. MAX_AUTHORIZATION_WAIT How long bot.did.listPendingAuthorizations will hold a request open. approve_authorization 🔒 POST /xrpc/bot.did.approveAuthorizationauthenticated_client 🔒 The confidential client a POST /oauth/token request authenticated as,
or None when it carries no client assertion. authorize_answer 🔒 Everything oauth_authorize authorize_error 🔒 authorize_error_page 🔒 The page oauth_authorizeerr stops it before it
finds a sign-in to show. authorize_page 🔒 The page GET /oauth/authorize serves for one decision. browser_answer 🔒 Everything oauth_browser browser_list 🔒 The accounts a browser is signed in as, and the cookie again when it
presented an id its session has since replaced. checked_proof 🔒 The DPoP proof a request to this authorization server carries, checked
against the absolute URL of path on this deployment. confirm_remembered 🔒 Approves the sign-in request_uri names without asking the account, when
this load meets every rule of
crate::oauth::authorize::confirms_unaskedcrate::oauth::authorize::answer create_browser_sign_in 🔒 POST /xrpc/bot.did.createBrowserSignIndecision_by_token 🔒 Reads one decision by its approval token, for the account the presented
credential authenticates as. decline_authorization 🔒 POST /xrpc/bot.did.declineAuthorizationdeployment_did 🔒 This deployment’s own DID, as a policy subject names it: empty before
the zone’s document exists. followed_from_here 🔒 Whether Sec-Fetch-Site lets a sign-in link through: absent, none for
a link a person or a tool opened directly, or same-origin. get_authorization 🔒 GET /xrpc/bot.did.getAuthorizationissue_approval 🔒 Approves record for did by spending token: issues the code, builds
the client’s redirect, and settles the record, holding the redirect when
a browser carries it. landing_headers 🔒 response, uncached and under the landing page’s content security
policy, as every answer from the two sign-in routes is, a redirect too.list_pending_authorizations 🔒 GET /xrpc/bot.did.listPendingAuthorizationsnever_cached 🔒 Marks every answer from POST /oauth/par and POST /oauth/token
uncacheable, success and refusal alike. oauth_authorize 🔒 GET /oauth/authorizeoauth_browser 🔒 GET /oauth/browseroauth_par 🔒 POST /oauth/paroauth_protected_resource_metadata 🔒 GET /.well-known/oauth-protected-resourceoauth_server_metadata 🔒 GET /.well-known/oauth-authorization-serveroauth_token 🔒 POST /oauth/tokenoauth_token_response 🔒 on_issuer_host 🔒 Whether a request was made to the issuer’s own host, as its Host or its
HTTP/2 authority names it. par_refusal 🔒 What a refused push answers, and how loudly it is written. pending_authorizations 🔒 The one answer shape bot.did.listPendingAuthorizations has, built in
one place so the wait’s three exits cannot drift apart. see_other 🔒 303 See Other to location, which a browser follows with a GET
whatever method brought it here. placeholder heads the page if it
cannot.token_refusal 🔒 What a refused exchange or refresh answers, and how loudly it is
written. too_many_oauth_requests 🔒 The 429 the unauthenticated OAuth endpoints answer with; see
OAuthError::rate_limited with_browser_cookie 🔒 response, setting crate::oauth::browser::COOKIEbrowser’s
current session id. placeholder heads the page if it cannot.