Class BrowserOAuthClientProvider

constructor

• new BrowserOAuthClientProvider(
      serverUrl: string,
      options?: OAuthProviderOptions,
  ): BrowserOAuthClientProvider

  Parameters

  • serverUrl: string
  • options: OAuthProviderOptions = {}

  Returns BrowserOAuthClientProvider

ReadonlyonPopupWindow

Optional ReadonlypreventAutoAuth

ReadonlyserverUrl

Optional ReadonlystaticClientInfo

callbackUrl

• get callbackUrl(): string

  OAuth redirect URI.

  Returns string

clientMetadata

• get clientMetadata(): {}

  Metadata about this OAuth client.

  Returns {}

clientMetadataUrl

• get clientMetadataUrl(): string | undefined

  External URL the server should use to fetch client metadata document

  Returns string | undefined

clientName

• get clientName(): string

  Human-readable OAuth client name.

  Returns string

clientUri

• get clientUri(): string

  Public website describing the OAuth client.

  Returns string

hasPendingFlow

• get hasPendingFlow(): boolean

  Whether an authorization flow is awaiting completion.

  Returns boolean

logoUri

• get logoUri(): string

  Public OAuth client logo URL.

  Returns string

redirectUrl

• get redirectUrl(): string

  The URL to redirect the user agent to after authorization. Return undefined for non-interactive flows that don't require user interaction (e.g., client_credentials, jwt-bearer).

  Returns string

scope

• get scope(): string | undefined

  Space-delimited OAuth scopes requested by the client.

  Returns string | undefined

serverUrlHash

• get serverUrlHash(): string

  Stable hash used to namespace storage for this server.

  Returns string

storageKeyPrefix

• get storageKeyPrefix(): string

  Prefix used for persisted OAuth keys.

  Returns string

clearStorage

• clearStorage(): number

  Removes OAuth state stored for this server.

  Returns number

  The number of storage entries removed.

clientInformation

• clientInformation(ctx?: OAuthClientInformationContext): Promise<{} | undefined>

  Returns the configured or dynamically registered OAuth client information.

  Parameters

  • Optionalctx: OAuthClientInformationContext

    Optional registration context.

  Returns Promise<{} | undefined>

  OAuth client information, or undefined when not registered.

codeVerifier

• codeVerifier(): Promise<string>

  Loads the PKCE code verifier for the current session, necessary to validate the authorization result.

  Returns Promise<string>

discoveryState

• discoveryState(): Promise<OAuthDiscoveryState | undefined>

  Return previously saved OAuth discovery state, or undefined.

  Returns Promise<OAuthDiscoveryState | undefined>

getClientCredentials

• getClientCredentials(): Promise<{ client_id: string } | null>

  Return the stored public OAuth client ID. Browser providers do not retain client secrets.

  Returns Promise<{ client_id: string } | null>

getKey

• getKey(keySuffix: string): string

  Returns a provider-scoped storage key.

  Parameters

  • keySuffix: string

    Suffix identifying the stored value.

  Returns string

  Namespaced storage key.

getLastAttemptedAuthUrl

• getLastAttemptedAuthUrl(): string | null

  Retrieves the last URL passed to redirectToAuthorization. Useful for manual fallback.

  Returns string | null

getProxyFetch

• getProxyFetch(
      baseFetch?: {
          (input: URL | RequestInfo, init?: RequestInit): Promise<Response>;
          (input: string | URL | Request, init?: RequestInit): Promise<Response>;
      },
  ): | {
      (input: URL | RequestInfo, init?: RequestInit): Promise<Response>;
      (input: string | URL | Request, init?: RequestInit): Promise<Response>;
  }
  | undefined

  Returns a fetch function, scoped to this provider, that routes OAuth metadata and non-browser OAuth endpoint requests through the configured oauthProxyUrl to bypass CORS. Authorization endpoints are navigated by the browser and all unrelated requests pass through unchanged.

  Unlike patching the global fetch, the returned function only affects the transport/auth calls it is explicitly handed to (via the SDK transport's fetch option or auth({ fetchFn })). Connecting one server "Via Proxy" therefore never alters fetch behavior for other servers, other connections, or the rest of the page.

  OAuth metadata is always fetched with cache: "no-store", including in direct mode. Authorization servers commonly vary CORS headers by Origin; bypassing the browser HTTP cache prevents a revalidated response cached for another localhost origin from poisoning discovery. When OAuth proxying is disabled or no oauthProxyUrl is configured, all requests still go directly to their original URLs.

  Parameters

  • OptionalbaseFetch: {
        (input: URL | RequestInfo, init?: RequestInit): Promise<Response>;
        (input: string | URL | Request, init?: RequestInit): Promise<Response>;
    }

    The fetch used for non-OAuth requests and for the underlying proxy calls. Defaults to the global fetch.

    • • (input: URL | RequestInfo, init?: RequestInit): Promise<Response>

      • MDN Reference

        Parameters

        • input: URL | RequestInfo
        • Optionalinit: RequestInit

        Returns Promise<Response>

      • (input: string | URL | Request, init?: RequestInit): Promise<Response>

      • MDN Reference

        Parameters

        • input: string | URL | Request
        • Optionalinit: RequestInit

        Returns Promise<Response>

  Returns
      | {
          (input: URL | RequestInfo, init?: RequestInit): Promise<Response>;
          (input: string | URL | Request, init?: RequestInit): Promise<Response>;
      }
      | undefined

  • {
        (input: URL | RequestInfo, init?: RequestInit): Promise<Response>;
        (input: string | URL | Request, init?: RequestInit): Promise<Response>;
    }
    • • (input: URL | RequestInfo, init?: RequestInit): Promise<Response>

      • MDN Reference

        Parameters

        • input: URL | RequestInfo
        • Optionalinit: RequestInit

        Returns Promise<Response>

      • (input: string | URL | Request, init?: RequestInit): Promise<Response>

      • MDN Reference

        Parameters

        • input: string | URL | Request
        • Optionalinit: RequestInit

        Returns Promise<Response>

  • undefined

getResource

• getResource(): Promise<string | null>

  Return the protected-resource URL selected during OAuth discovery.

  Returns Promise<string | null>

getTokenEndpoint

• getTokenEndpoint(): Promise<string | null>

  Return the token endpoint from the SDK's persisted discovery state. Returns null before a successful authorization discovery.

  Returns Promise<string | null>

invalidateCredentials

• invalidateCredentials(
      scope: "tokens" | "all" | "client" | "verifier" | "discovery",
  ): Promise<void>

  If implemented, provides a way for the client to invalidate (e.g. delete) the specified credentials, in the case where the server has indicated that they are no longer valid. This avoids requiring the user to intervene manually.

  Parameters

  • scope: "tokens" | "all" | "client" | "verifier" | "discovery"

  Returns Promise<void>

markFlowComplete

• markFlowComplete(): void

  Marks the current authorization flow as complete.

  Returns void

prepareAuthorizationUrl

• prepareAuthorizationUrl(authorizationUrl: URL): Promise<string>

  Generates and persists StoredState for an authorization request, and returns the sanitized URL with the state param appended. Does NOT open a popup or redirect — use redirectToAuthorization for that.

  Parameters

  • authorizationUrl: URL

  Returns Promise<string>

redirectToAuthorization

• redirectToAuthorization(authorizationUrl: URL): Promise<void>

  Redirects the user agent to the authorization URL, storing necessary state.

  Parameters

  • authorizationUrl: URL

    The fully constructed authorization URL from the SDK.

  Returns Promise<void>

saveClientInformation

• saveClientInformation(
      clientInformation: {},
      ctx?: OAuthClientInformationContext,
  ): Promise<void>

  Persists public OAuth client registration information.

  Static client configuration takes precedence, and browser providers discard any client secret returned for a public client.

  Parameters

  • clientInformation: {}

    Registration information to save.

  • Optionalctx: OAuthClientInformationContext

    Optional registration context.

  Returns Promise<void>

saveCodeVerifier

• saveCodeVerifier(codeVerifier: string): Promise<void>

  Saves a PKCE code verifier for the current session, before redirecting to the authorization flow.

  Parameters

  • codeVerifier: string

  Returns Promise<void>

saveDiscoveryState

• saveDiscoveryState(state: OAuthDiscoveryState): Promise<void>

  Persist OAuth discovery state (SEP-2352). Delegated to the session store; implementing this silences the SDK's per-callback warning and enables the authorization-server mix-up defense on the callback leg.

  Parameters

  • state: OAuthDiscoveryState

  Returns Promise<void>

saveTokens

• saveTokens(tokens: {}, ctx?: OAuthClientInformationContext): Promise<void>

  Stores new OAuth tokens for the current session, after a successful authorization.

  Parameters

  • tokens: {}
  • Optionalctx: OAuthClientInformationContext

    Carries the resolved authorization-server issuer. Providers that persist tokens per authorization server should store the entry keyed by ctx.issuer.

  Returns Promise<void>

tokens

• tokens(ctx?: OAuthClientInformationContext): Promise<{} | undefined>

  Loads any existing OAuth tokens for the current session, or returns undefined if there are no saved tokens.

  Parameters

  • Optionalctx: OAuthClientInformationContext

    Carries the resolved authorization-server issuer. Providers that persist tokens per authorization server should return the entry keyed by ctx.issuer. Providers with a single token set may ignore it. When called with no ctx — the transport's per-request bearer-token read — return the most-recently-saved token set; do not return undefined for ctx === undefined.

  Returns Promise<{} | undefined>