Interface: ClientStore

Defined in: oauthServerTypes.ts:81

App-provided store for OAuth clients. The core owns protocol mechanics; the app owns persistence (DynamoDB, Postgres, in-memory, …).

Properties

get

get: (clientId) => OAuthClient | Promise<OAuthClient | undefined> | undefined

Defined in: oauthServerTypes.ts:89

Look up a client by its client_id. Return undefined if unknown.

A store that implements ClientStore.verifyClientSecret should omit client_secret from the returned document — the core never needs the raw value, and leaving it out keeps it from reaching consent screens or logs.

Parameters

Parameter	Type
clientId	string

Returns

OAuthClient | Promise<OAuthClient | undefined> | undefined

---

register

register: (client) => void | Promise<void>

Defined in: oauthServerTypes.ts:93

Persist a newly registered client.

Parameters

Parameter	Type
client	OAuthClient

Returns

void | Promise<void>

---

verifyClientSecret?

optional verifyClientSecret?: (args) => boolean | Promise<boolean>

Defined in: oauthServerTypes.ts:108

Verifies a client_secret presented at the token endpoint. Implement this to keep secrets hashed at rest: the core hands over the presented value and the store compares it against its own stored form, so the raw secret never has to be recoverable.

Return true for a public client (one registered with token_endpoint_auth_method: 'none', which has no secret to present), and false for an unknown client_id.

When omitted, the core falls back to a constant-time comparison against the client_secret returned by ClientStore.get — which requires the store to keep the secret recoverable.

Parameters

Parameter	Type	Description
args	{ clientId: string; clientSecret: string | undefined; }	-
args.clientId	string	The client_id being authenticated.
args.clientSecret	string | undefined	The secret presented by the client, absent when none was sent.

Returns

boolean | Promise<boolean>