Skip to main content

Interface: OAuthServerOptions

Defined in: auth-core/src/oauthServerTypes.ts:372

Configuration for createOAuthHandlers.

Properties​

authCodeStore​

authCodeStore: AuthCodeStore

Defined in: auth-core/src/oauthServerTypes.ts:378

App-provided store for short-lived authorization codes.

authorizationCodeTtl?​

optional authorizationCodeTtl?: number

Defined in: auth-core/src/oauthServerTypes.ts:418

Authorization code lifetime in seconds.

Default​

600

clientStore​

clientStore: ClientStore

Defined in: auth-core/src/oauthServerTypes.ts:376

App-provided store for dynamic clients.

endpoints?​

optional endpoints?: object

Defined in: auth-core/src/oauthServerTypes.ts:420

Override the default endpoint paths.

authorize?​

optional authorize?: string

Default​
'/authorize'

register?​

optional register?: string

Default​
'/register'

token?​

optional token?: string

Default​
'/token'

issuer​

issuer: string

Defined in: auth-core/src/oauthServerTypes.ts:374

The authorization server's issuer identifier (its base URL).

issueTokens​

issueTokens: (args) => IssuedTokens | Promise<IssuedTokens>

Defined in: auth-core/src/oauthServerTypes.ts:383

App-owned token minting. The core never sees the user model or signing keys — it hands you the subject/scopes/client and you return the tokens.

Parameters​

ParameterType
argsIssueTokensArgs

Returns​

IssuedTokens | Promise<IssuedTokens>

onAuthorize​

onAuthorize: (args) => OnAuthorizeResult | Promise<OnAuthorizeResult>

Defined in: auth-core/src/oauthServerTypes.ts:389

App-owned login/consent. Called on every authorize request; return the authenticated subject to approve, or { approved: false, redirect } to send the user to your own login/consent UI.

Parameters​

ParameterType
argsOnAuthorizeArgs

Returns​

OnAuthorizeResult | Promise<OnAuthorizeResult>

onRefreshToken?​

optional onRefreshToken?: (args) => OnRefreshTokenResult | Promise<OnRefreshTokenResult>

Defined in: auth-core/src/oauthServerTypes.ts:396

App-owned refresh-token validation. Required to support the refresh_token grant; when omitted, refresh requests get unsupported_grant_type.

Parameters​

ParameterType
argsOnRefreshTokenArgs

Returns​

OnRefreshTokenResult | Promise<OnRefreshTokenResult>

resource?​

optional resource?: string

Defined in: auth-core/src/oauthServerTypes.ts:413

The resource this server issues tokens for. When set:

  • OAuthHandlers.protectedResourceMetadata is served, pairing this resource URL with the issuer as its authorization server (RFC 9728), with scopesSupported as its scopes_supported.
  • A resource parameter (RFC 8707) on /authorize or /token must name it, else the request fails with invalid_target.
  • issueTokens receives it as resource, to bind the token's audience.

When unset, resource parameters are ignored.

scopesSupported?​

optional scopesSupported?: string[]

Defined in: auth-core/src/oauthServerTypes.ts:400

Scopes advertised in discovery metadata (scopes_supported).