Reference

Package	Version	Modules	Description
`vestibule`	`0.0.0`	13	Strategy-based OAuth2 authentication for Gleam
`vestibule_apple`	`0.0.0`	3	Apple Sign In strategy for vestibule
`vestibule_github`	`0.0.0`	1	GitHub OAuth strategy for vestibule
`vestibule_google`	`0.0.0`	1	Google OAuth strategy for vestibule
`vestibule_indieauth`	`0.0.0`	4	IndieAuth strategy for vestibule — decentralized identity via OAuth 2.0
`vestibule_microsoft`	`0.0.0`	1	Microsoft OAuth strategy for vestibule
`vestibule_mist`	`0.0.0`	2	Mist middleware for vestibule OAuth authentication
`vestibule_oidc`	`0.0.0`	1	OpenID Connect discovery for vestibule — auto-configure strategies from an issuer URL
`vestibule_wisp`	`0.0.0`	1	Wisp middleware for vestibule OAuth authentication

Package	Module	Description
`vestibule`	`vestibule`	Vestibule — a strategy-based authentication library for Gleam.
`vestibule`	`vestibule/auth`	Authentication result types returned to the calling application after a successful OAuth/OIDC flow.
`vestibule`	`vestibule/authorization_request`	An opaque value carrying everything the middleware needs to start an authorization flow: the URL to redirect the browser to, the CSRF `state`, the PKCE `code_verifier`, and an optional OIDC `nonce`, all of which must be stored for the callback.
`vestibule`	`vestibule/config`	OAuth client configuration and per-authorization request options.
`vestibule`	`vestibule/credentials`	Bearer credentials returned by a provider after a successful token exchange or refresh.
`vestibule`	`vestibule/error`	Authentication error types.
`vestibule`	`vestibule/logger`	Reference for vestibule/logger.
`vestibule`	`vestibule/nonce`	OIDC `nonce` generation and constant-time validation. A fresh 256-bit base64url nonce is minted for every OIDC authorization request, sent as the `nonce` authorize-request parameter, and echoed back by the provider in the signed `id_token`. On callback the value read from the id_token is compared against the stored value to bind the token to this browser session, preventing id_token replay/injection.
`vestibule`	`vestibule/provider_support`	Stable helpers for OAuth provider implementations.
`vestibule`	`vestibule/registry`	In-memory registry that maps provider names (“google”, “apple”, …) to `Strategy` values. Used by the middleware to dispatch incoming authorize/callback requests to the right provider.
`vestibule`	`vestibule/state_store`	Single-use storage for in-flight OAuth flow state (CSRF `state` and PKCE `code_verifier`). Entries are deleted on first read to prevent replay.
`vestibule`	`vestibule/strategy`	Provider-strategy interface. A `Strategy(e)` is an opaque record bundling the provider-specific functions an OAuth/OIDC provider implements: build authorize URL, exchange code, fetch user, and an optional refresh token.
`vestibule`	`vestibule/user_info`	Normalized user profile returned by a provider’s userinfo endpoint or extracted from an ID token. Provider-specific fields land in `extra`.
`vestibule_apple`	`vestibule_apple`	Apple Sign In strategy for vestibule.
`vestibule_apple`	`vestibule_apple/jwks`	Apple JWKS (JSON Web Key Set) fetching and caching.
`vestibule_apple`	`vestibule_apple/jwt`	JWT verification using ywt_core with a custom Erlang FFI backend.
`vestibule_github`	`vestibule_github`	Reference for vestibule_github.
`vestibule_google`	`vestibule_google`	Google OAuth 2.0 / OIDC strategy.
`vestibule_indieauth`	`vestibule_indieauth`	Reference for vestibule_indieauth.
`vestibule_indieauth`	`vestibule_indieauth/discovery`	Reference for vestibule_indieauth/discovery.
`vestibule_indieauth`	`vestibule_indieauth/token`	Reference for vestibule_indieauth/token.
`vestibule_indieauth`	`vestibule_indieauth/url`	Reference for vestibule_indieauth/url.
`vestibule_microsoft`	`vestibule_microsoft`	Microsoft Identity Platform (v2.0) strategy.
`vestibule_mist`	`vestibule_mist`	Mist middleware that wires a `Registry` of `Strategy` values into HTTP endpoints.
`vestibule_mist`	`vestibule_mist/signed_cookie`	HMAC-SHA256 signed cookie payload helpers.
`vestibule_oidc`	`vestibule_oidc`	OpenID Connect Discovery support for auto-configuring strategies.
`vestibule_wisp`	`vestibule_wisp`	Wisp middleware that wires a `Registry` of `Strategy` values into HTTP endpoints.

StartOverviewOpen the Vestibule overview page.

PackagesPackage overviewChoose the right Vestibule package for a Gleam OAuth integration.

StartSearch docsSearch Vestibule documentation and package guides.

StartQuick startAdd Vestibule to a Gleam app and wire the OAuth request and callback phases.

ReferenceReferenceGenerated API reference from Gleam docs metadata for every Vestibule package.

API referencevestibule API docsOpen the generated API reference for vestibule.

ExtendWriting a custom strategyBuild a Vestibule OAuth2 provider strategy from scratch.

Referencevestibule/authAuthentication result types returned to the calling application after a successful OAuth/OIDC flow.

Referencevestibule/authorization_requestAn opaque value carrying everything the middleware needs to start an authorization flow: the URL to redirect the browser to, the CSRF `state`, the PKCE `code_verifier`, and an optional OIDC `nonce`, all of which must be stored for the callback.

Referencevestibule/configOAuth client configuration and per-authorization request options.

Referencevestibule/credentialsBearer credentials returned by a provider after a successful token exchange or refresh.

Referencevestibule/errorAuthentication error types.

Referencevestibule/loggerReference for vestibule/logger.

Referencevestibule/nonceOIDC `nonce` generation and constant-time validation. A fresh 256-bit base64url nonce is minted for every OIDC authorization request, sent as the `nonce` authorize-request parameter, and echoed back by the provider in the signed `id_token`. On callback the value read from the id_token is compared against the stored value to bind the token to this browser session, preventing id_token replay/injection.

Referencevestibule/provider_supportStable helpers for OAuth provider implementations.

Referencevestibule/registryIn-memory registry that maps provider names ("google", "apple", ...) to `Strategy` values. Used by the middleware to dispatch incoming authorize/callback requests to the right provider.

ExtendOIDC discoveryBuild a Vestibule strategy from any OpenID Connect provider's issuer URL, including self-hosted providers.

Referencevestibule/state_storeSingle-use storage for in-flight OAuth flow state (CSRF `state` and PKCE `code_verifier`). Entries are deleted on first read to prevent replay.

Referencevestibule/strategyProvider-strategy interface. A `Strategy(e)` is an opaque record bundling the provider-specific functions an OAuth/OIDC provider implements: build authorize URL, exchange code, fetch user, and an optional refresh token.

Referencevestibule/user_infoNormalized user profile returned by a provider's userinfo endpoint or extracted from an ID token. Provider-specific fields land in `extra`.

API referencevestibule_apple API docsOpen the generated API reference for vestibule_apple.

Referencevestibule_apple/jwksApple JWKS (JSON Web Key Set) fetching and caching.

Referencevestibule_apple/jwtJWT verification using ywt_core with a custom Erlang FFI backend.

API referencevestibule_github API docsOpen the generated API reference for vestibule_github.

API referencevestibule_google API docsOpen the generated API reference for vestibule_google.

API referencevestibule_indieauth API docsOpen the generated API reference for vestibule_indieauth.

Referencevestibule_indieauth/discoveryReference for vestibule_indieauth/discovery.

Referencevestibule_indieauth/tokenReference for vestibule_indieauth/token.

Referencevestibule_indieauth/urlReference for vestibule_indieauth/url.

API referencevestibule_microsoft API docsOpen the generated API reference for vestibule_microsoft.

API referencevestibule_mist API docsOpen the generated API reference for vestibule_mist.

Referencevestibule_mist/signed_cookieHMAC-SHA256 signed cookie payload helpers.

API referencevestibule_oidc API docsOpen the generated API reference for vestibule_oidc.

API referencevestibule_wisp API docsOpen the generated API reference for vestibule_wisp.

Core packagevestibule packageCore types, two-phase OAuth2 flow, PKCE, CSRF state, token refresh, OIDC discovery, and shared state store.

Wisp middlewarevestibule_wisp packageWisp request/callback routing for Vestibule, including signed session cookie handling and one-time ETS state storage.

Mist middlewarevestibule_mist packagePlain Mist request/callback routing with HMAC-SHA256 signed session cookies and the shared Vestibule state store.

Provider strategyvestibule_github packageGitHub OAuth strategy with normalized profile data and verified-primary-email lookup.

Provider strategyvestibule_google packageGoogle OAuth strategy with verified-email handling, hosted-domain enforcement, and refresh-token guidance.

Provider strategyvestibule_microsoft packageMicrosoft OAuth strategy using Microsoft Graph /me, with helpers for tenant-specific sign-in.

Provider strategyvestibule_apple packageSign in with Apple strategy with JWKS-backed ID token verification and form_post callback support.

Provider strategyvestibule_indieauth packageDecentralized IndieAuth strategy where users sign in with a URL they control and endpoints are discovered dynamically.

Provider strategyvestibule_oidc packageOpenID Connect discovery that auto-configures a strategy from any standards-compliant issuer URL, including self-hosted providers.

Packages

Modules