Package overview
Vestibule is split by responsibility: core flow, transport middleware, and provider strategy packages.
Choose who owns the auth routes
Start with Wisp or Mist middleware when your server layer should own request and callback routes. Use core directly when your app owns that transport boundary.
For Wisp appsvestibule_wispUse Wisp middleware when your app already routes requests with Wisp and you want the request and callback phases handled for you.Wisp request/callback routing for Vestibule, including signed session cookie handling and one-time ETS state storage.Read package guideFor plain Mist appsvestibule_mistUse Mist middleware when you run directly on Mist and want the same auth ergonomics without Wisp.Plain Mist request/callback routing with HMAC-SHA256 signed session cookies and the shared Vestibule state store.Read package guideFor custom routingvestibuleUse the core package when you want direct control over request and callback phases, or when you are building your own transport integration.Core types, two-phase OAuth2 flow, PKCE, CSRF state, token refresh, OIDC discovery, and shared state store.Read package guide
Add provider strategies after the route shape
Provider packages plug into the base request/callback flow. Choose them for the identity providers your app supports.
| Provider package | Default scopes | Important behavior |
|---|---|---|
| vestibule_github | user:email | Requests user:email by default. |
| vestibule_google | openid email profile | user_info.email only returns a value when email_verified is true. |
| vestibule_microsoft | openid User.Read | The default strategy uses /common and performs no tenant validation. |
| vestibule_apple | name email | init initializes the JWKS cache used to verify Apple ID tokens. |
| vestibule_indieauth | profile | Identity is a URL — auth.uid(auth) returns the user's canonical me URL. |
| vestibule_oidc | openid profile email | One-step discover reads /.well-known/openid-configuration and builds a Strategy. |
Read generated API reference
Reference pages are generated from Gleam docs metadata during the website build, so they stay aligned with each package's public API.
| Package | Reference |
|---|---|
| vestibule | Open generated reference |
| vestibule_wisp | Open generated reference |
| vestibule_mist | Open generated reference |
| vestibule_github | Open generated reference |
| vestibule_google | Open generated reference |
| vestibule_microsoft | Open generated reference |
| vestibule_apple | Open generated reference |
| vestibule_indieauth | Open generated reference |
| vestibule_oidc | Open generated reference |