Search docs
Find the page, package, or API reference you need. Results stay visible without JavaScript; typing narrows them in place.
45 results
No matching docs found. Clear the search or try a provider name, package name, or OAuth term.
- StartOverviewOpen the Vestibule overview page.
- PackagesPackage overviewChoose the right Vestibule package for a Gleam OAuth integration.
- StartSearch docsSearch Vestibule documentation and package guides.
- StartInstallationInstall Vestibule packages from GitHub with Gleam 1.18 or later.
- StartQuick startAdd Vestibule to a Gleam app and wire the OAuth request and callback phases.
- ReferenceReferenceGenerated API reference from Gleam docs metadata for every Vestibule package.
- API referencevestibule API docsOpen the generated API reference for vestibule.
- ExtendWriting a custom strategyBuild a Vestibule OAuth2 provider strategy from scratch.
- Referencevestibule/authAuthentication result types returned to the calling application after a successful OAuth/OIDC flow.
- Referencevestibule/authorization_requestAn opaque value carrying everything the middleware needs to start an authorization flow: the URL to redirect the browser to, the CSRF `state`, the PKCE `code_verifier`, and an optional OIDC `nonce`, all of which must be stored for the callback.
- Referencevestibule/configOAuth client configuration and per-authorization request options.
- Referencevestibule/credentialBearer credentials returned by a provider after a successful token exchange or refresh.
- Referencevestibule/errorAuthentication error types.
- Referencevestibule/loggerReference for vestibule/logger.
- Referencevestibule/nonceOIDC `nonce` generation and constant-time validation. A fresh 256-bit base64url nonce is minted for every OIDC authorization request, sent as the `nonce` authorize-request parameter, and echoed back by the provider in the signed `id_token`. On callback the value read from the id_token is compared against the stored value to bind the token to this browser session, preventing id_token replay/injection.
- Referencevestibule/provider_supportStable helpers for OAuth provider implementations.
- Referencevestibule/registryIn-memory registry that maps provider names ("google", "apple", ...) to `Strategy` values. Used by the middleware to dispatch incoming authorize/callback requests to the right provider.
- ExtendOIDC discoveryBuild a Vestibule strategy from any OpenID Connect provider's issuer URL, including self-hosted providers.
- Referencevestibule/state_storeSingle-use storage for in-flight OAuth flow state (CSRF `state` and PKCE `code_verifier`). Entries are deleted on first read to prevent replay.
- Referencevestibule/strategyProvider-strategy interface. A `Strategy(e)` is an opaque record bundling the provider-specific functions an OAuth/OIDC provider implements: build authorize URL, exchange code, fetch user, and an optional refresh token.
- Referencevestibule/user_infoNormalized user profile returned by a provider's userinfo endpoint or extracted from an ID token. Provider-specific fields land in `extra`.
- API referencevestibule_apple API docsOpen the generated API reference for vestibule_apple.
- Referencevestibule_apple/jwksApple JWKS (JSON Web Key Set) fetching and caching.
- Referencevestibule_apple/jwtJWT verification using ywt_core with a custom Erlang FFI backend.
- API referencevestibule_github API docsOpen the generated API reference for vestibule_github.
- API referencevestibule_google API docsOpen the generated API reference for vestibule_google.
- API referencevestibule_indieauth API docsOpen the generated API reference for vestibule_indieauth.
- Referencevestibule_indieauth/discoveryIndieAuth endpoint discovery.
- Referencevestibule_indieauth/profileProfile URL confirmation for the IndieAuth callback phase.
- Referencevestibule_indieauth/tokenIndieAuth token exchange and response parsing.
- Referencevestibule_indieauth/urlURL validation and canonicalization for IndieAuth.
- API referencevestibule_microsoft API docsOpen the generated API reference for vestibule_microsoft.
- API referencevestibule_mist API docsOpen the generated API reference for vestibule_mist.
- Referencevestibule_mist/signed_cookieHMAC-SHA256 signed cookie payload helpers.
- API referencevestibule_oidc API docsOpen the generated API reference for vestibule_oidc.
- API referencevestibule_wisp API docsOpen the generated API reference for vestibule_wisp.
- Core packagevestibule packageCore types, a two-phase OAuth2 flow, PKCE, CSRF state, token refresh, and a shared state store.
- Wisp middlewarevestibule_wisp packageWisp request and callback routing with signed session cookies and single-use ETS state storage.
- Mist middlewarevestibule_mist packagePlain Mist request and callback routing with HMAC-SHA256 signed session cookies and the shared Vestibule state store.
- Provider strategyvestibule_github packageGitHub OAuth strategy with normalized profile data and verified-primary-email lookup.
- Provider strategyvestibule_google packageGoogle OAuth strategy with verified-email handling, hosted-domain enforcement, and refresh-token guidance.
- Provider strategyvestibule_microsoft packageMicrosoft OAuth strategy that uses Microsoft Graph /me and supports tenant-specific sign-in.
- Provider strategyvestibule_apple packageSign in with Apple strategy that verifies ID tokens with JWKS and supports form_post callbacks.
- Provider strategyvestibule_indieauth packageDecentralized IndieAuth strategy for sign-in with a user-controlled URL and endpoints discovered at run time.
- Provider strategyvestibule_oidc packageOpenID Connect discovery that builds a strategy from a standards-compliant issuer URL, including a self-hosted provider.