oidc-caep-client
    Preparing search index...

    Interface OIDCClientConfig

    interface OIDCClientConfig {
        allowInsecureRequests?: boolean;
        clientId: string;
        clockToleranceSec?: number;
        discoveryCacheTtlMs?: number;
        dpop?: boolean | { alg?: string; key?: DPoPKey; keyStore?: KeyStore };
        enforceAcr?: boolean;
        fetch?: (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;
        httpTimeoutMs?: number;
        idTokenSignedResponseAlg?: string;
        issuer?: string;
        maxIdTokenAgeSec?: number;
        metadata?: Record<string, any>;
        par?: "auto" | "always" | "never";
        postLogoutRedirectUri?: string;
        redirectUri?: string;
        requireAuthTime?: boolean;
        requireDpop?: boolean;
        resource?: string | string[];
        scope?: string;
        transactionStore?: TransactionStore;
        transactionTtlSec?: number;
        userinfoSignedResponseAlg?: string;
    }
    Index
    allowInsecureRequests? clientId clockToleranceSec? discoveryCacheTtlMs? dpop? enforceAcr? fetch? httpTimeoutMs? idTokenSignedResponseAlg? issuer? maxIdTokenAgeSec? metadata? par? postLogoutRedirectUri? redirectUri? requireAuthTime? requireDpop? resource? scope? transactionStore? transactionTtlSec? userinfoSignedResponseAlg?
    allowInsecureRequests?: boolean

    Allow non-TLS endpoints and redirect URIs other than loopback (default false).

    clientId: string

    A PUBLIC client (token_endpoint_auth_method "none").

    clockToleranceSec?: number

    Allowed clock skew (default 30).

    discoveryCacheTtlMs?: number

    How long discovered metadata is cached (default 1h).

    dpop?: boolean | { alg?: string; key?: DPoPKey; keyStore?: KeyStore }

    DPoP (RFC 9449). true generates a non-extractable key kept in memory; pass keyStore (e.g. new IndexedDBKeyStore()) to keep it across page loads.

    enforceAcr?: boolean

    When acr_values were requested, require the ID token's acr to be one of them (default true).

    fetch?: (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>

    Custom fetch implementation.

    Type Declaration

      • (input: RequestInfo | URL, init?: RequestInit): Promise<Response>

      • MDN Reference

        Parameters

        • input: RequestInfo | URL
        • Optionalinit: RequestInit

        Returns Promise<Response>

    httpTimeoutMs?: number

    Per-request timeout (default 10000).

    idTokenSignedResponseAlg?: string

    Expected ID token alg (default RS256).

    issuer?: string

    Issuer; metadata is loaded from <issuer>/.well-known/openid-configuration.

    maxIdTokenAgeSec?: number

    Reject ID tokens whose iat is older than this (default 600).

    metadata?: Record<string, any>

    A provider metadata document to use instead of discovery.

    par?: "auto" | "always" | "never"

    Pushed Authorization Requests (RFC 9126). Default "auto": used when advertised.

    postLogoutRedirectUri?: string
    redirectUri?: string
    requireAuthTime?: boolean

    Require auth_time in every ID token (default false).

    requireDpop?: boolean

    With DPoP enabled, refuse a token response whose token_type is Bearer (RFC 9449 §5: the AS may fall back, but this client asked for bound tokens). Default: true when dpop is set. A refresh of DPoP-bound tokens never accepts Bearer, whatever this says.

    resource?: string | string[]

    RFC 8707 resource indicator(s): audience-restricts the tokens.

    scope?: string

    Default "openid profile email offline_access" (offline_access only if supported).

    transactionStore?: TransactionStore

    Where state/nonce/PKCE verifier wait for the callback (default sessionStorage).

    transactionTtlSec?: number

    How long an authorization request stays redeemable (default 600).

    userinfoSignedResponseAlg?: string

    The only alg a signed UserInfo response may use. Default: any asymmetric algorithm.

    Settings
    Member Visibility

    On This Page
    Properties