OAuth2

Whether the flow type mandates client identification.

If non-nil, will be called before performing dynamic client registration, giving you a chance to instantiate your own registrar.

The authorizer to use for UI handling, depending on platform.

Designated initializer.

The following settings keys are currently supported:

• client_id (String)
• client_secret (String), usually only needed for code grant
• authorize_uri (URL-String)
• token_uri (URL-String), if omitted the authorize_uri will be used to obtain tokens
• refresh_uri (URL-String), if omitted the token_uri will be used to obtain tokens
• redirect_uris (Array of URL-Strings)

• scope (String)

• client_name (String)

• registration_uri (URL-String)

• logo_uri (URL-String)

• keychain (Bool, true by default, applies to using the system keychain)

• keychain_access_mode (String, value for keychain kSecAttrAccessible attribute, kSecAttrAccessibleWhenUnlocked by default)

• keychain_access_group (String, value for keychain kSecAttrAccessGroup attribute, nil by default)

• keychain_account_for_client_credentials(String, “clientCredentials” by default)

• keychain_account_for_tokens(String, “currentTokens” by default)

• secret_in_body (Bool, false by default, forces the flow to use the request body for the client secret)

• token_assume_unexpired (Bool, true by default, whether to use access tokens that do not come with an “expires_in” parameter)

• use_pkce (Bool, false by default)

• verbose (bool, false by default, applies to client logging)

Use this method to obtain an access token. Take a look at authConfig on how to configure how authorization is presented to the user.

This method is running asynchronously and can only be run one at a time.

This method will first check if the client already has an unexpired access token (possibly from the keychain), if not and it’s able to use a refresh token it will try to use the refresh token. If this fails it will check whether the client has a client_id and show the authorize screen if you have authConfig set up sufficiently. If authConfig is not set up sufficiently this method will end up calling the callback with a failure. If client_id is not set but a “registration_uri” has been provided, a dynamic client registration will be attempted and if it success, an access token will be requested.

Shortcut function to start embedded authorization from the given context (a UIViewController on iOS, an NSWindow on OS X).

This method sets authConfig.authorizeEmbedded = true and authConfig.authorizeContext = <# context #>, then calls authorize()

If the instance has an accessToken, checks if its expiry time has not yet passed. If we don’t have an expiry date we assume the token is still valid.

Attempts to receive a new access token by:

1. checking if there still is an unexpired token
2. attempting to use a refresh token

Indicates, in the callback, whether the client has been able to obtain an access token that is likely to still work (but there is no guarantee!) or not.

Method to actually start authorization. The public authorize() method only proceeds to this method if there is no valid access token and if optional client registration succeeds.

Can be overridden in subclasses to perform an authorization dance different from directing the user to a website.

Open the authorize URL in the OS’s browser. Forwards to the receiver’s authorizer, which is a platform-dependent implementation of OAuth2AuthorizerUI.

Tries to use the current auth config context, which on iOS should be a UIViewController and on OS X a NSViewController, to present the authorization screen. Set oauth2.authConfig.authorizeContext accordingly.

Forwards to the receiver’s authorizer, which is a platform-dependent implementation of OAuth2AuthorizerUI.

Method that creates the OAuth2AuthRequest instance used to create the authorize URL

Most convenient method if you want the authorize URL to be created as defined in your settings dictionary.

Convenience method to be overridden by and used from subclasses.

Generate the request to be used for token refresh when we have a refresh token.

This will set “grant_type” to “refresh_token”, add the refresh token, and take care of the remaining parameters.

If there is a refresh token, use it to receive a fresh access token.

If the request returns an error, the refresh token is thrown away.

Use OAuth2 dynamic client registration to register the client, if needed.

Returns immediately if the receiver’s clientId is nil (with error = nil) or if there is no registration URL (with error). Otherwise calls onBeforeDynamicClientRegistration() – if it is non-nil – and uses the returned OAuth2DynReg instance – if it is non-nil. If both are nil, instantiates a blank OAuth2DynReg instead, then attempts client registration.