oidc_core library

Support for doing something awesome.

More dartdocs go here.

Classes

OidcAggregatedClaimSource
OidcAuthorizationHookRequest
OidcAuthorizeRequest
A class that describes an /authorize request.
OidcAuthorizeResponse
Successful Authentication Response
OidcAuthorizeState
Represents a state that takes a snapshot of the request parameters and some settings to ensure nothing changes during the flow.
OidcClaimSource
OidcClientAuthentication
OidcClientRegistrationRequest
Client metadata for OAuth 2.0 Dynamic Client Registration (RFC 7591 §2), also used as the body of an RFC 7592 client update.
OidcClientRegistrationResponse
Response from an OAuth 2.0 Dynamic Client Registration endpoint (RFC 7591 §3.2.1), also returned by RFC 7592 read/update operations.
OidcColorSchemeParams
CustomTabColorSchemeParams for one color scheme.
OidcConstants_AccessTokenTypes
OidcConstants_ApplicationType
OpenID Connect Dynamic Client Registration 1.0 §2 application_type.
OidcConstants_AuthorizationEndpoint_ResponseType
The response_type options defined by the spec
OidcConstants_AuthorizeRequest_CodeChallengeMethod
OidcConstants_AuthorizeRequest_Display
The display options defined by the spec.
OidcConstants_AuthorizeRequest_Prompt
The prompt options defined by the spec
OidcConstants_AuthorizeRequest_ResponseMode
OidcConstants_AuthParameters
OidcConstants_ClientAssertionTypes
OidcConstants_ClientAuthenticationMethods
OidcConstants_DeviceAuthorizationErrors
RFC 8628 (OAuth 2.0 Device Authorization Grant) error codes.
OidcConstants_DeviceAuthorizationPolling
RFC 8628 polling defaults.
OidcConstants_Exception
OidcConstants_GrantType
OidcConstants_JWTClaims
OidcConstants_OperationDiscriminators
OidcConstants_ProviderMetadata
OidcConstants_RequestMethod
OidcConstants_RevocationParameters
The parameters used in the revocation endpoint
OidcConstants_RevocationParameters_TokenType
The token type hints defined by the spec
OidcConstants_Scopes
OidcConstants_Store
OidcConstants_TokenExchange_TokenType
RFC 8693 Token Exchange token type identifiers, used for subject_token_type / actor_token_type / requested_token_type.
OidcConstants_WebFinger
OpenID Connect Discovery 1.0 §2 (OpenID Provider Issuer Discovery) + RFC 7033 (WebFinger) protocol constants.
OidcConstants_WebFinger_JRD
RFC 7033 §4.4 JSON Resource Descriptor (JRD) top-level member names.
RFC 7033 §4.4.4 link-relation-object member names.
OidcCustomTabsColorSchemes
Color configuration for the Custom Tab (maps to setColorScheme + setColorSchemeParams / setDefaultColorSchemeParams).
OidcDeviceAuthorizationRequest
A class that describes an /authorize request.
OidcDeviceAuthorizationResponse
OidcDistributedClaimSource
OidcDPoPManager
Holds the per-session DPoP proof key + nonce cache and mints DPoP proofs (RFC 9449).
OidcDPoPSettings
Enables and configures DPoP (Demonstrating Proof of Possession, RFC 9449) for an OidcUserManager.
OidcDurationSecondsConverter
OidcDynamicClientRegistrationSettings
Enables + configures RFC 7591 Dynamic Client Registration for an OidcUserManager.
OidcEndpoints
Helper class for dart-based openid connect clients.
OidcEndSessionConfirmationEvent
An event raised once per RP-initiated logout, after the manager has asked the OP's check_session_iframe (OpenID Connect Session Management 1.0 §3.1) whether the session the RP just ended is still the OP's current session.
OidcEndSessionRequest
OidcEndSessionResponse
OidcEndSessionState
Represents a state that takes a snapshot of the request parameters and some settings to ensure nothing changes during the flow.
OidcErrorMonitorSessionResult
OidcErrorResponse
OidcEvent
Represents an arbitrary event.
OidcForceFreshJwksLoader
A one-shot JsonWebKeySetLoader used to force a live, cache-busted JWKS refetch when no OidcStore is available to persist an offline fallback copy — the cacheStore-less OidcUser.fromIdToken path.
OidcFrontChannelLogoutIncomingRequest
OidcFrontChannelRequestListeningOptions
OidcFrontChannelRequestListeningOptions_Web
OidcHook<TRequest, TResponse>
OidcHookBase<TRequest, TResponse>
OidcHookGroup<TRequest, TResponse>
A group of OIDC hooks that can be executed together.
OidcIdTokenValidationContext
Inputs to id_token validation that depend on the flow that produced the token, rather than on the token itself.
OidcIdTokenVerificationOptions
OidcInternalUtilities
OidcIntrospectionRequest
An OAuth 2.0 Token Introspection request (RFC 7662 §2.1).
OidcIntrospectionResponse
Response from an OAuth 2.0 Token Introspection endpoint (RFC 7662 §2.2).
OidcJwksStoreLoader
OidcMemoryStore
A simple OidcStore implementation that relies on memory and doesn't actually store anything.
OidcMonitorSessionResult
OidcMonitorSessionStatusRequest
OidcMtls
Builds the certificate-bearing http.Client for RFC 8705 mutual TLS.
OidcMtlsClientCertificate
The X.509 client certificate (and its private key) presented on the TLS connection for RFC 8705 mutual-TLS client authentication and certificate-bound access tokens.
OidcMtlsEndpointAliases
RFC 8705 §5 mtls_endpoint_aliases: a JSON object of alternative authorization-server endpoints that a client doing mutual TLS uses in preference to the conventional (top-level) endpoints.
OidcNativeOptionsAndroid
Android options for the first-party Chrome Custom Tabs flow.
OidcNativeOptionsApple
iOS / macOS options for the first-party ASWebAuthenticationSession flow.
OidcNumericDateConverter
OidcOfflineAuthErrorHandler
Utility class to categorize errors for offline authentication handling.
OidcOfflineAuthWarningEvent
An event that gets raised to warn about security implications of offline authentication.
OidcOfflineModeEnteredEvent
An event that gets raised when the user manager enters offline mode.
OidcOfflineModeExitedEvent
An event that gets raised when the user manager exits offline mode.
OidcPartialCustomTabs
Partial (bottom-sheet) Custom Tab configuration.
OidcPkcePair
A pair of (codeVerifier, codeChallenge) that can be used with PKCE (Proof Key for Code Exchange).
OidcPlatformOptionsMarker
Marker interface implemented by every per-platform native-options object.
OidcPlatformSpecificOptions
Represents flutter platform-specific options.
OidcPlatformSpecificOptions_Native
OidcPlatformSpecificOptions_Web
OidcPreLogoutEvent
An event that gets raised before the user is forgotten.
OidcProviderMetadata
The "OpenID Provider Metadata" as standardized by the spec https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata This also includes some metadata that are defined by other extensions
OidcPushedAuthorizationRequest
See https://datatracker.ietf.org/doc/html/rfc9126
OidcPushedAuthorizationResponse
The response of a Pushed Authorization Request (PAR).
OidcReadOnlyStore
An abstract interface for fetching data.
OidcRequestObjectSettings
Configuration for JWT-Secured Authorization Requests (JAR, RFC 9101): signing the authorization request parameters into a request JWT.
OidcRevocationHookRequest
OidcRevocationRequest
OidcRevocationResponse
Response from a token revocation endpoint.
OidcSessionManagementSettings
OidcSimpleAuthorizationCodeFlowRequest
This authorization request takes only the minimal parameters and generates the rest.
OidcSimpleAuthorizationRequestContainer
The result of processing an OidcSimpleAuthorizationCodeFlowRequest or OidcSimpleImplicitFlowRequest.
OidcSimpleImplicitFlowRequest
This authorization request takes only the minimal parameters and generates the rest.
OidcState
Base class for any state
OidcStepUpChallenge
A parsed OAuth 2.0 WWW-Authenticate challenge from a protected-resource 401 response, with first-class support for the RFC 9470 step-up authentication challenge (error="insufficient_user_authentication").
OidcStore
An abstract interface for storing/fetching data.
OidcToken
Represents a serializable token.
OidcTokenEventsManager
OidcTokenExpiredEvent
An event that gets raised after a token expired.
OidcTokenExpiringEvent
An event that gets raised before a token expires.
OidcTokenHookRequest
OidcTokenRefreshFailedEvent
An event raised whenever an OAuth 2.0 refresh-token grant (RFC 6749 §6) fails, from any of the three refresh paths (see OidcTokenRefreshSource).
OidcTokenRequest
See https://developer.okta.com/docs/reference/api/oidc/
OidcTokenResponse
OidcUnknownMonitorSessionResult
OidcUser
A user is a verified JWT id_token, with an optional access_token.
OidcUserInfoFailedEvent
An event raised when a UserInfo request (OpenID Connect Core §5.3) made while re-validating an already-authenticated session is rejected by the resource server with an HTTP 401 Unauthorized.
OidcUserInfoResponse
OidcUserInfoSettings
OidcUserManagerBase
This class manages a single user's authentication status.
OidcUserManagerHooks
A collection of hooks for the OIDC User Manager.
OidcUserManagerSettings
OidcUtils
Utilities for the Oidc spec
OidcValidMonitorSessionResult
OidcValueStream<T>
A minimal value-caching broadcast stream.
OidcWebFingerIdentifier
The output of OpenID Connect Discovery 1.0 §2.1 Identifier Normalization.
RFC 7033 §4.4.4 link relation object.
OidcWebFingerResponse
RFC 7033 §4.4 JSON Resource Descriptor (JRD).

Enums

OfflineAuthErrorType
Types of errors that can occur during authentication.
OfflineAuthWarningType
Types of offline authentication warnings.
OfflineModeReason
The reason why offline mode was entered.
OidcAppleCallbackMode
Selects the ASWebAuthenticationSession callback type.
OidcAppleNavigationMode
Selects how the macOS authorization / end-session flow reaches the OpenID Provider.
OidcAuthTabMode
Selects the redirect-capture model on Android.
OidcColorScheme
Color scheme for the Custom Tab (maps to setColorScheme).
OidcCustomTabsCloseButtonPosition
Where the close button sits (maps to setCloseButtonPosition).
OidcCustomTabsShareState
Whether the Custom Tab shows a default share action (maps to setShareState).
OidcCustomTabsWarmup
Optional pre-warming of the Custom Tabs service.
OidcDPoPAlgorithm
The asymmetric signature algorithm used for the DPoP proof key.
OidcEndSessionConfirmationOutcome
The outcome reported by an OidcEndSessionConfirmationEvent.
OidcIdTokenSource
Where the id_token being validated came from.
OidcInitMode
Controls how OidcUserManagerBase.init restores a previously-cached user.
OidcPartialTabResizeBehavior
Resize behavior of a partial (bottom-sheet) Custom Tab.
OidcPlatformSpecificOptions_Web_NavigationMode
The possible navigation modes to use for web.
OidcPushedAuthorizationRequestsMode
Controls whether the authorization-code login flow uses RFC 9126 Pushed Authorization Requests (PAR).
OidcStoreNamespace
OidcTokenRefreshFailureKind
Classifies a refresh failure as recoverable or not, per RFC 6749 §5.2.
OidcTokenRefreshSource
Identifies which code path attempted the refresh that failed.
OidcUserInfoAccessTokenLocations

Mixins

OidcExecutionHookMixin<TRequest, TResponse>

Constants

oidcDPoPHeaderName → const String
The HTTP request header that carries a DPoP proof JWT (RFC 9449 §4).
oidcDPoPNonceHeaderName → const String
The HTTP response header that conveys a server-provided DPoP nonce (RFC 9449 §8 / §9).
oidcDPoPProofTyp → const String
The DPoP proof JOSE header typ value (RFC 9449 §4.2).
oidcDPoPUseNonceError → const String
The OAuth error code a server returns to demand a DPoP nonce (RFC 9449 §8 / §9).

Properties

jwksForceRefetchTimestamps → Map<String, DateTime>
Tracks, per issuer, the last time a verification failure triggered a forced JWKS refetch. Process-lifetime only (deliberately not persisted): the goal is rate-limiting a hot loop within a running process, not surviving restarts.
final

Functions

cacheBustJwksUri(Uri uri) → Uri
Appends a unique query parameter to uri so a request through it defeats any HTTP/CDN-level response caching sitting in front of the JWKS endpoint.
defaultOfflineRefreshRetryDelay(int consecutiveFailures) → Duration
Default threshold for emitting repeat refresh failure warnings. The default retry delay function with exponential backoff. Returns delays of: 30s, 1m, 2m, 4m, 5m (capped at 5 minutes).
defaultRefreshBefore(OidcToken token) → Duration?
The default refreshBefore function, which refreshes 1 minute before the token expires.
oidcComputeTokenHash(String alg, String value) → String?
Computes an OpenID Connect at_hash / c_hash value (OIDC Core §3.2.2.9 / §3.3.2.11): the base64url (no padding) encoding of the LEFT-MOST HALF of the hash of ASCII(value), using the SHA-2 hash matching the id_token's JOSE alg (*256 -> SHA-256, *384 -> SHA-384, *512 -> SHA-512).
oidcCreateDPoPProof({required JsonWebKey key, required String algorithm, required String htm, required Uri htu, String? accessToken, String? nonce, Duration clockSkew = Duration.zero}) → String
Builds a DPoP proof JWT (RFC 9449 §4.2) signed by key with algorithm (e.g. ES256).
oidcCreateRequestObject({required Map<String, dynamic> parameters, required JsonWebKey key, required String algorithm, required String issuer, required String audience, Duration lifetime = const Duration(minutes: 5), Duration clockSkew = Duration.zero, Random? random}) → String
Builds a signed JWT-Secured Authorization Request object (RFC 9101 §4) from the authorization parameters.
oidcDPoPAth(String accessToken) → String
Computes the ath claim — base64url (no padding) of SHA-256(ASCII(token)) — binding a DPoP proof to an access token (RFC 9449 §4.2 / §7.1).
oidcDPoPPublicJwk(JsonWebKey key) → Map<String, dynamic>
Projects key to its public JWK members only (RFC 9449 §4.2 requires the embedded jwk to contain no private key material), with EC coordinates normalized to their full curve length.
oidcExecuteHook<TRequest, TResponse>({required TRequest request, required OidcHookExecution<TRequest, TResponse> defaultExecution, required OidcHookMixin<TRequest, TResponse>? hook}) → Future<TResponse>
oidcGenerateDPoPJti() → String
Generates a fresh, unique DPoP proof identifier (jti) with >= 96 bits of entropy (RFC 9449 §4.2), as a base64url (no padding) string.
oidcGenerateRequestObjectJti([Random? random]) → String
Generates a random jti for a request object.
oidcJwkThumbprint(JsonWebKey key) → String
Computes the RFC 7638 JWK Thumbprint of key using SHA-256, returned as a base64url (no padding) string.
oidcNormalizeHtu(Uri uri) → String
Normalizes a target URI for the htu claim (RFC 9449 §4.2/§4.3): the scheme and host lowercased, default ports dropped, and the query + fragment removed.
oidcReadJwtAlg(String jwt) → String?
Reads the alg from a compact-JWS jwt's JOSE header, or null if it can't be parsed.

Typedefs

OidcClientRegistrationRequestBuilder = OidcClientRegistrationRequest Function(OidcProviderMetadata metadata)
Builds the RFC 7591 client metadata posted to the OP's registration_endpoint. Called with the resolved discovery document so the metadata can be adapted to what the OP advertises.
OidcHookExecution<TRequest, TResponse> = Future<TResponse> Function(TRequest request)
OidcIsLoadedTokenAcceptableCallback = bool? Function(OidcUser user, List<Exception> validationErrors)
The callback used by OidcUserManagerSettings.isLoadedTokenAcceptable to decide, when tokens are restored from the OidcStore during init(), whether the loaded token should be treated as acceptable despite (or in the absence of) validation errors.
OidcOfflineRefreshRetryDelayCallback = Duration Function(int consecutiveFailures)
The callback used to determine the retry delay for offline mode refresh attempts.
OidcRefreshBeforeCallback = Duration? Function(OidcToken token)
The callback used to determine the expiring duration.
OidcShouldRemoveInvalidTokenCallback = bool? Function(OidcUser user, List<Exception> validationErrors)
The callback used by OidcUserManagerSettings.shouldRemoveInvalidToken to decide whether a loaded-but-invalid token is removed from the OidcStore.

Exceptions / Errors

OidcException
OidcInteractionRequiredException
Thrown when the session cannot be renewed without user interaction.