Search docs
Find the page, package, or API reference you need. Results stay visible without JavaScript; typing narrows them in place.
43 results
No matching docs found. Clear the search or try a provider name, package name, or OAuth term.
- StartOverviewOpen the Vestibule overview page.
- PackagesPackage overviewChoose the right Vestibule package for a Gleam OAuth integration.
- StartSearch docsSearch Vestibule documentation and package guides.
- StartQuick startAdd Vestibule to a Gleam app and wire the OAuth request and callback phases.
- ReferenceReferenceGenerated API reference from Gleam docs metadata for every Vestibule package.
- API referencevestibule API docsOpen the generated API reference for vestibule.
- ExtendWriting a custom strategyBuild a Vestibule OAuth2 provider strategy from scratch.
- Referencevestibule/authAuthentication result types returned to the calling application after a successful OAuth/OIDC flow.
- Referencevestibule/authorization_requestAn opaque value carrying everything the middleware needs to start an authorization flow: the URL to redirect the browser to, the CSRF `state`, the PKCE `code_verifier`, and an optional OIDC `nonce`, all of which must be stored for the callback.
- Referencevestibule/configOAuth client configuration and per-authorization request options.
- Referencevestibule/credentialsBearer credentials returned by a provider after a successful token exchange or refresh.
- Referencevestibule/errorAuthentication error types.
- Referencevestibule/loggerReference for vestibule/logger.
- Referencevestibule/nonceOIDC `nonce` generation and constant-time validation. A fresh 256-bit base64url nonce is minted for every OIDC authorization request, sent as the `nonce` authorize-request parameter, and echoed back by the provider in the signed `id_token`. On callback the value read from the id_token is compared against the stored value to bind the token to this browser session, preventing id_token replay/injection.
- Referencevestibule/provider_supportStable helpers for OAuth provider implementations.
- Referencevestibule/registryIn-memory registry that maps provider names ("google", "apple", ...) to `Strategy` values. Used by the middleware to dispatch incoming authorize/callback requests to the right provider.
- ExtendOIDC discoveryBuild a Vestibule strategy from any OpenID Connect provider's issuer URL, including self-hosted providers.
- Referencevestibule/state_storeSingle-use storage for in-flight OAuth flow state (CSRF `state` and PKCE `code_verifier`). Entries are deleted on first read to prevent replay.
- Referencevestibule/strategyProvider-strategy interface. A `Strategy(e)` is an opaque record bundling the provider-specific functions an OAuth/OIDC provider implements: build authorize URL, exchange code, fetch user, and an optional refresh token.
- Referencevestibule/user_infoNormalized user profile returned by a provider's userinfo endpoint or extracted from an ID token. Provider-specific fields land in `extra`.
- API referencevestibule_apple API docsOpen the generated API reference for vestibule_apple.
- Referencevestibule_apple/jwksApple JWKS (JSON Web Key Set) fetching and caching.
- Referencevestibule_apple/jwtJWT verification using ywt_core with a custom Erlang FFI backend.
- API referencevestibule_github API docsOpen the generated API reference for vestibule_github.
- API referencevestibule_google API docsOpen the generated API reference for vestibule_google.
- API referencevestibule_indieauth API docsOpen the generated API reference for vestibule_indieauth.
- Referencevestibule_indieauth/discoveryReference for vestibule_indieauth/discovery.
- Referencevestibule_indieauth/tokenReference for vestibule_indieauth/token.
- Referencevestibule_indieauth/urlReference for vestibule_indieauth/url.
- API referencevestibule_microsoft API docsOpen the generated API reference for vestibule_microsoft.
- API referencevestibule_mist API docsOpen the generated API reference for vestibule_mist.
- Referencevestibule_mist/signed_cookieHMAC-SHA256 signed cookie payload helpers.
- API referencevestibule_oidc API docsOpen the generated API reference for vestibule_oidc.
- API referencevestibule_wisp API docsOpen the generated API reference for vestibule_wisp.
- Core packagevestibule packageCore types, two-phase OAuth2 flow, PKCE, CSRF state, token refresh, OIDC discovery, and shared state store.
- Wisp middlewarevestibule_wisp packageWisp request/callback routing for Vestibule, including signed session cookie handling and one-time ETS state storage.
- Mist middlewarevestibule_mist packagePlain Mist request/callback routing with HMAC-SHA256 signed session cookies and the shared Vestibule state store.
- Provider strategyvestibule_github packageGitHub OAuth strategy with normalized profile data and verified-primary-email lookup.
- Provider strategyvestibule_google packageGoogle OAuth strategy with verified-email handling, hosted-domain enforcement, and refresh-token guidance.
- Provider strategyvestibule_microsoft packageMicrosoft OAuth strategy using Microsoft Graph /me, with helpers for tenant-specific sign-in.
- Provider strategyvestibule_apple packageSign in with Apple strategy with JWKS-backed ID token verification and form_post callback support.
- Provider strategyvestibule_indieauth packageDecentralized IndieAuth strategy where users sign in with a URL they control and endpoints are discovered dynamically.
- Provider strategyvestibule_oidc packageOpenID Connect discovery that auto-configures a strategy from any standards-compliant issuer URL, including self-hosted providers.