Package overview

Vestibule separates the core flow, transport middleware, and provider strategies into different packages.

Choose who owns the auth routes

Start with Wisp or Mist middleware if it can handle the request and callback routes. Use core directly if your app must handle those routes.

Add provider packages to the base request and callback flow. Add one package for each identity provider that your app supports.

Provider package comparison
Provider package	Default scopes	Important behavior
vestibule_github	user:email	Requests user:email by default.
vestibule_google	openid email profile	user_info.email only returns a value when email_verified is true.
vestibule_microsoft	openid User.Read	The default strategy uses /common and performs no tenant validation.
vestibule_apple	name email	init initializes the JWKS cache used to verify Apple ID tokens.
vestibule_indieauth	profile	The identity is a URL. auth.uid(auth) returns the user's canonical me URL.
vestibule_oidc	openid profile email	discover reads /.well-known/openid-configuration and builds a Strategy.

The website build generates reference pages from Gleam docs metadata. Thus, each page matches the package's public API.