Instance methods
access_token_audience
The aud of the access tokens issued, i.e. which API they are for. Defaults to base_url.
A resource server that sets the same audience on its verifier refuses tokens meant for others.
access_token_audience=(access_token_audience : String | Nil)
The aud of the access tokens issued, i.e. which API they are for. Defaults to base_url.
A resource server that sets the same audience on its verifier refuses tokens meant for others.
access_ttl=(access_ttl : Time::Span)
Sourcealgorithm=(algorithm : JWT::Algorithm)
Sourceallow_dynamic_registration=(allow_dynamic_registration : Bool)
Dynamic Client Registration
allow_dynamic_registration?
Dynamic Client Registration
attempt_limiter
Throttles guessing at the device verification page. Share it between nodes, and make its increment atomic
(see AttemptLimiter).
attempt_limiter=(attempt_limiter : AttemptLimiter)
Throttles guessing at the device verification page. Share it between nodes, and make its increment atomic
(see AttemptLimiter).
attempt_source
Who a request counts as for attempt_limiter and registration_limiter: the client address by default. Behind a reverse proxy that is
the proxy, so return the address your proxy vouches for (or nil to count by account only).
attempt_source=(attempt_source : AttemptSource)
Who a request counts as for attempt_limiter and registration_limiter: the client address by default. Behind a reverse proxy that is
the proxy, so return the address your proxy vouches for (or nil to count by account only).
authenticate_registration
Sourceauthenticate_registration=(authenticate_registration : RegistrationAuthenticator | Nil)
Sourceauthenticate_user
The authorization endpoint (/oauth/authorize) and the device verification page (/device) act on
behalf of a resource owner, and Authly does not own the login. The host application supplies the
signed-in owner here, from its own session. It is the ONLY source of the subject: user_id and
consent request parameters are never read. While it is unset those endpoints refuse every request.
authenticate_user=(authenticate_user : OwnerAuthenticator | Nil)
The authorization endpoint (/oauth/authorize) and the device verification page (/device) act on
behalf of a resource owner, and Authly does not own the login. The host application supplies the
signed-in owner here, from its own session. It is the ONLY source of the subject: user_id and
consent request parameters are never read. While it is unset those endpoints refuse every request.
base_url
OpenID Connect Configuration
base_url=(base_url : String)
OpenID Connect Configuration
challenge_max_attempts=(challenge_max_attempts : Int32)
Sourcechallenge_store
Challenge-Response Authentication
challenge_store=(challenge_store : ChallengeStore)
Challenge-Response Authentication
challenge_ttl=(challenge_ttl : Time::Span)
Sourceclient_store=(client_store : ClientStore)
Sourceclients=(clients : AuthorizableClient)
Sourcecode_ttl=(code_ttl : Time::Span)
Sourceconsent_ttl
How long a consent form (and its anti-CSRF token) stays valid.
consent_ttl=(consent_ttl : Time::Span)
How long a consent form (and its anti-CSRF token) stays valid.
default_jarm_response_mode
Sourcedefault_jarm_response_mode=(default_jarm_response_mode : String | Nil)
Sourcedevice_attempt_limit
User code lookups one signed-in owner, and one source, may make at the device page per window (an approval is two).
device_attempt_limit=(device_attempt_limit : Int32)
User code lookups one signed-in owner, and one source, may make at the device page per window (an approval is two).
device_attempt_window=(device_attempt_window : Time::Span)
Sourcedevice_code_store=(device_code_store : DeviceCodeStore)
Sourceenforce_pkce=(enforce_pkce : Bool)
Sourceenforce_pkce_s256=(enforce_pkce_s256 : Bool)
Sourcegrant_types=(grant_types : Array(String))
Sourceissuance_options
Trusted host callback; never populated from OAuth request parameters.
issuance_options=(issuance_options : Proc(String, String, IssuanceOptions) | Nil)
Trusted host callback; never populated from OAuth request parameters.
issue_refresh_tokens=(issue_refresh_tokens : Bool)
Sourceissuer=(issuer : String)
Sourcejarm_encryption_alg=(jarm_encryption_alg : String | Nil)
Sourcejarm_encryption_enc=(jarm_encryption_enc : String | Nil)
Sourcejarm_encryption_key=(jarm_encryption_key : String | Nil)
Sourcejarm_lifetime=(jarm_lifetime : Time::Span)
Sourcejarm_signing_alg=(jarm_signing_alg : JWT::Algorithm)
Sourcejarm_signing_key
JWT Secured Authorization Response Mode (JARM)
jarm_signing_key=(jarm_signing_key : String | Nil)
JWT Secured Authorization Response Mode (JARM)
login_url
Optional. When nobody is signed in, redirect to the URL this returns (a login page that sends the
owner back afterwards) instead of answering 401 login_required.
login_url=(login_url : LoginRedirect | Nil)
Optional. When nobody is signed in, redirect to the URL this returns (a login page that sends the
owner back afterwards) instead of answering 401 login_required.
on_social_authenticated
Sourceon_social_authenticated=(on_social_authenticated : Proc(HTTP::Server::Context, SocialProfile, String, AccessToken | Nil, Nil) | Nil)
Sourceowners=(owners : AuthorizableOwner)
Sourcepar_store
Pushed Authorization Requests (PAR)
par_store=(par_store : PARStore)
Pushed Authorization Requests (PAR)
par_ttl=(par_ttl : Time::Span)
Sourcepublic_key=(public_key : String | Nil)
The key tokens are verified with. For HMAC algorithms (the default) it has to be the
signing key, so it follows secret_key until it is set to something else, such as the
public half of an asymmetric pair.
refresh_absolute_ttl
How long a refresh token family (the chain of tokens one sign-in yields through rotation) may be renewed
in all, counted from the sign-in: no refresh token outlives it, however often it is rotated.
refresh_absolute_ttl=(refresh_absolute_ttl : Time::Span)
How long a refresh token family (the chain of tokens one sign-in yields through rotation) may be renewed
in all, counted from the sign-in: no refresh token outlives it, however often it is rotated.
refresh_ttl=(refresh_ttl : Time::Span)
Sourceregister_social_provider(provider : Social::Provider) : Social::Provider
Sourceregistration_access_token
Sourceregistration_access_token=(registration_access_token : String | Nil)
Sourceregistration_grant_types
Sourceregistration_grant_types=(registration_grant_types : Array(String))
Sourceregistration_limiter
Throttles failed authentications at the registration endpoint. A limiter of its own, so that a flood of failed
registrations from many sources cannot fill the device limiter (a full limiter refuses every new key).
registration_limiter=(registration_limiter : AttemptLimiter)
Throttles failed authentications at the registration endpoint. A limiter of its own, so that a flood of failed
registrations from many sources cannot fill the device limiter (a full limiter refuses every new key).
registration_max_body
Sourceregistration_max_body=(registration_max_body : Int32)
Sourceregistration_rate_limit
Failed authentications per source per window; requests with valid credentials are not counted.
registration_rate_limit=(registration_rate_limit : Int32)
Failed authentications per source per window; requests with valid credentials are not counted.
registration_rate_window
Sourceregistration_rate_window=(registration_rate_window : Time::Span)
Sourceregistration_response_types
Sourceregistration_response_types=(registration_response_types : Array(String))
Sourceregistration_scopes=(registration_scopes : Array(String))
Sourcerender_consent=(render_consent : Proc(HTTP::Server::Context, AuthorizationRequest, String, String, Nil) | Nil)
Sourcerequire_certificate_bound_tokens=(require_certificate_bound_tokens : Bool)
Certificate-Bound Tokens (mTLS)
require_certificate_bound_tokens?
Certificate-Bound Tokens (mTLS)
require_par=(require_par : Bool)
Sourcesecret_key=(secret_key : String)
Sourcesigning_key_id=(signing_key_id : String | Nil)
Sourcesocial_http_client=(social_http_client : Social::HttpClient)
Sourcesocial_owner_resolver=(social_owner_resolver : Proc(SocialProfile, String | Nil) | Nil)
Sourcesocial_providers
Social Sign-In Authentication
social_providers=(social_providers : Hash(String, Social::Provider))
Social Sign-In Authentication
social_state_ttl=(social_state_ttl : Time::Span)
Sourcestate_store=(state_store : StateStore)
Sourcetoken_audience
Blank counts as unset: with neither an audience nor a base_url, tokens carry no aud.
token_store=(token_store : TokenStore)
Sourcetoken_strategy=(token_strategy : Symbol)
Sourcetrusted_ca_certificates=(trusted_ca_certificates : Array(String))
Sourceuserinfo=(userinfo : Proc(String, Hash(String, JSON::Any)) | Nil)
Sourceverification_keys=(verification_keys : Hash(String, String))
Source