Signin class

AWS Sign-In manages authentication for AWS services. This service provides secure authentication flows for accessing AWS resources from the console and developer tools.

Constructors

Signin({required String region, AwsClientCredentials? credentials, AwsClientCredentialsProvider? credentialsProvider, Client? client, String? endpointUrl, bool useFipsEndpoint = false, bool useDualStackEndpoint = false})

factory

Properties

hashCode → int

The hash code for this object.

no setter, inherited

runtimeType → Type

A representation of the runtime type of the object.

no setter, inherited

Methods

close() → void

Closes the internal HTTP client if none was provided at creation. If a client was passed as a constructor argument, this becomes a noop.

createOAuth2Token({required CreateOAuth2TokenRequestBody tokenInput}) → Future<CreateOAuth2TokenResponse>

CreateOAuth2Token API Path: /v1/token Request Method: POST Content-Type: application/json or application/x-www-form-urlencoded This API implements OAuth 2.0 flows for AWS Sign-In CLI clients, supporting both: 1. Authorization code redemption (grant_type=authorization_code) - NOT idempotent 2. Token refresh (grant_type=refresh_token) - Idempotent within token validity window The operation behavior is determined by the grant_type parameter in the request body: Authorization Code Flow (NOT Idempotent): - JSON or form-encoded body with client_id, grant_type=authorization_code, code, redirect_uri, code_verifier - Returns access_token, token_type, expires_in, refresh_token, and id_token - Each authorization code can only be used ONCE for security (prevents replay attacks) Token Refresh Flow (Idempotent): - JSON or form-encoded body with client_id, grant_type=refresh_token, refresh_token - Returns access_token, token_type, expires_in, and refresh_token (no id_token) - Multiple calls with same refresh_token return consistent results within validity window Authentication and authorization: - Confidential clients: sigv4 signing required with signin:ExchangeToken permissions - CLI clients (public): authn/authz skipped based on client_id & grant_type Note: This operation cannot be marked as @idempotent because it handles both idempotent (token refresh) and non-idempotent (auth code redemption) flows in a single endpoint.

createOAuth2TokenWithIAM({required String grantType, required String resource}) → Future<CreateOAuth2TokenWithIAMResponse>

Grants permission to exchange client credentials for an OAuth 2.0 access token scoped to a resource that can be used to access AWS services from applications

deleteConsoleAuthorizationConfiguration({String? targetId}) → Future<DeleteConsoleAuthorizationConfigurationOutput>

Delete console authorization configuration with automatic scope detection

deleteResourcePermissionStatement({required String statementId, String? clientToken}) → Future<void>

Remove a permission statement from the account's SignIn resource-based policy

getConsoleAuthorizationConfiguration({String? targetId}) → Future<GetConsoleAuthorizationConfigurationOutput>

Get console authorization configuration with automatic scope detection

getResourcePolicy() → Future<GetResourcePolicyOutput>

Retrieve the account's consolidated SignIn resource-based policy

introspectOAuth2TokenWithIAM({required String token, String? tokenTypeHint}) → Future<IntrospectOAuth2TokenWithIAMResponse>

Grants permission to inspect the metadata and state of an OAuth 2.0 access token or refresh token Implements RFC 7662 OAuth 2.0 Token Introspection over a SigV4-authenticated endpoint. Inspects the metadata of an access_token or refresh_token issued by AWS Sign-In and returns the claims associated with it. Inactive token semantics (RFC 7662 §2.2): when the supplied token is unknown, expired, revoked, malformed, or owned by a different account, the response body is exactly { "active": false } with all other claims omitted.

listResourcePermissionStatements({int? maxResults, String? nextToken}) → Future<ListResourcePermissionStatementsOutput>

Retrieve all permission statements in the account's SignIn resource-based policy

noSuchMethod(Invocation invocation) → dynamic

Invoked when a nonexistent method or property is accessed.

inherited

putConsoleAuthorizationConfiguration({String? targetId}) → Future<PutConsoleAuthorizationConfigurationOutput>

Enable console authorization configuration with automatic scope detection

putResourcePermissionStatement({String? clientToken, String? consoleSourceVpce, String? excludedPrincipal, String? requestedRegion, String? signinSourceVpce, String? sourceIp, String? sourceVpc, String? vpcSourceIp}) → Future<PutResourcePermissionStatementOutput>

Create a permission statement in the account's SignIn resource-based policy

revokeOAuth2TokenWithIAM({required String token}) → Future<void>

Grants permission to revoke an OAuth 2.0 refresh token and its associated refresh tokens Revokes a refresh_token issued by AWS Sign-In, invalidating the entire token chain so that the refresh_token can no longer be used to mint new access_tokens. Idempotency: revoking an already-revoked, expired, or otherwise invalid token still returns 200 OK with an empty body. Only the refresh_token type is accepted.

toString() → String

A string representation of this object.

inherited

Operators

operator ==(Object other) → bool

The equality operator.

inherited