Add an `MAC Access Authentication`_ signature to headers. Unlike OAuth 1, this HMAC signature does not require inclusion of the request paylo

Prepare an access token refresh request. Expired access tokens can be replaced by new access tokens without going through the OAuth d

Add the client credentials to the request body. The client makes a request to the token endpoint by adding the following parameters u

Create and add a JWT assertion to the request body. :param private_key: Private key used for signing and encrypting.

Add device_code to request body The client makes a request to the token endpoint by adding the device_code as a parameter using the

Prepare a token revocation request. :param revocation_url: Provider token revocation endpoint URL. :param token: The access or refres

Near-constant time string comparison. Used in order to avoid timing attacks on sensitive information such as secret keys during request veri

Test sign and verify with RSA-SHA1.

Test sign and verify with RSA-SHA256.

Ensure client_id belong to a valid and active client. Note, while not strictly necessary it can often be very convenient to set reque

Verify a PLAINTEXT signature. Per `section 3.4`_ of the spec. .. _`section 3.4`: https://tools.ietf.org/html/rfc5849#section-3.4

If CORS is allowed, create the appropriate headers.

Obtains an RSAAlgorithm object that implements RSA with the hash algorithm. This method maintains the ``_jwt_rsa`` cache. Returns a jwt

Prepare a PEM encoded key (public or private), by invoking the `prepare_key` method on alg with the keystr. The keystr should be a strin

Raise error on missing token.

Raise on unsupported tokens.

Render a signed request according to signature type Returns a 3-tuple containing the request URI, headers, and body. If the formenco

Create PKCE **code_challenge** derived from the **code_verifier**. See `RFC7636 Section 4.2`_ :param code_verifier: REQUIRED. The **

Ensures that all parameters in a list of 2-element tuples are decoded to unicode using UTF-8.

The lifetime in seconds of the "device_code" and "user_code".

Get the default redirect URI for the client. :param client_id: Unicode client identifier. :param request: OAuthlib request. :

Get realms associated with a request token. :param token: The request token string. :param request: OAuthlib request. :type r

Indicate if the given origin is allowed to access the token endpoint via Cross-Origin Resource Sharing (CORS). CORS is used by browser-based

Determine if current request requires PKCE. Default, False. This is called for both "authorization" and "token" requests. Override th

Check if requested scopes are within a scope of the refresh token. When access tokens are refreshed the scope of the new token needs

Parse the implicit token response URI into a dict. If the resource owner grants the access request, the authorization server issues an access

Parse the URI query for code and state. If the resource owner grants the access request, the authorization server issues an authoriza

Place token according to response mode. Base classes can define a default response mode for their authorization response by overridin

Sign a request using plaintext. Per `section 3.4.4`_ of the spec. The "PLAINTEXT" method does not employ a signature algorithm. It MUST

Ensure client is authorized to use the response_type requested. :param client_id: Unicode client identifier. :param response_type: Un

Ensures token presence, token type, expiration and scope in params.

Check the token request for normal and fatal errors. :param request: OAuthlib request. :type request: oauthlib.common.Request

Performs the necessary check against the request to ensure it's allowed to retrieve a token.

Verify that the given OAuth1 request token is valid. :param token: A request token string. :param request: OAuthlib request.

:param description: A human-readable ASCII [USASCII] text providing additional information, used to assist the cl

Extracts parameters from query, headers and body. Signature type is set to the source in which parameters were found.

Checks that the token contains only safe characters and is no shorter than lower and no longer than upper.

Check that the client key only contains safe characters and is no shorter than lower and no longer than upper.

Checks that the nonce only contains only safe characters and is no shorter than lower and no longer than upper.

Checks that the request token contains only safe characters and is no shorter than lower and no longer than upper.

Checks that the verifier contains only safe characters and is no shorter than lower and no longer than upper.

Determine if client authentication is required for current request. According to the rfc8628, client authentication is required in the follow

Ensure that the authorization process represented by this authorization code began with this 'redirect_uri'. If the client specifies

Create and save a new access token. Similar to OAuth 2, indication of granted scopes will be included as a space separated list in ``

Generates an authorization grant represented as a dictionary. :param request: OAuthlib request. :type request: oauthlib.comm

Read scope and route to the designated handler.

Create metadata response

Create and save a new request token. :param request: OAuthlib request. :type request: oauthlib.common.Request :param credenti

Return token or error embedded in the URI fragment. :param request: OAuthlib request. :type request: oauthlib.common.Request

Create and save a new request token. :param request: OAuthlib request. :type request: oauthlib.common.Request :param credenti

Following the rfc, this will route the device request accordingly and raise required errors. Remember that unlike other auth

Ensures that all parameters in a list of 2-element tuples are encoded to bytestrings using UTF-8

Finalize OpenID Connect ID token & Sign or Encrypt. In the OpenID Connect workflows when an ID Token is requested this method is call

Token type identification. RFC 6749 does not provide a method for easily differentiating between different token types during protect

Generate a age parameter for MAC authentication draft 00.

Retrieves the shared secret associated with the access token. :param client_key: The client/consumer key. :param token: The access to

Extracts nonce from saved authorization code. If present in the Authentication Request, Authorization Servers MUST include a nonce C

Extracts scopes from saved authorization code. The scopes returned by this method is used to route token requests based on scopes pa

Retrieves the client secret associated with the client key. :param client_key: The client/consumer key. :param request: OAuthlib requ

Is called for every "token" requests. When the server issues the authorization code in the authorization response, it MUST associate

Is called during the "token" request processing, when a ``code_verifier`` and a ``code_challenge`` has been provided. See ``.get_code

Get debug mode value. :return: `True` if debug mode is on, `False` otherwise

Get the default realms for a client. :param client_key: The client/consumer key. :param request: OAuthlib request. :type requ

Get the default scopes for the client. :param client_id: Unicode client identifier. :param request: OAuthlib request. :type r

Get OpenID Connect ID token This method is OPTIONAL and is NOT RECOMMENDED. `finalize_id_token` SHOULD be implemented instead. Howeve

Get JWT Bearer token or OpenID Connect ID token If using OpenID Connect this SHOULD call `oauthlib.oauth2.RequestValidator.get_id_token`

Get an OAuth signature to be used in signing a request To satisfy `section 3.4.1.2`_ item 2, if the request argument's headers dict a

Get the list of scopes associated with the refresh token. :param refresh_token: Unicode refresh token. :param request: OAuthlib reque

Fetch realms and credentials for the presented request token. :param uri: The full URI of the token request. :param http_method: A va

Get the redirect URI associated with a request token. :param token: The request token string. :param request: OAuthlib request.

Retrieves the shared secret associated with the request token. :param client_key: The client/consumer key. :param token: The request

Retrieves a previously stored client provided RSA key. :param client_key: The client/consumer key. :param request: OAuthlib request.

Return the UserInfo claims in JSON or Signed or Encrypted. The UserInfo Claims MUST be returned as the members of a JSON object unle

Introspect an access or refresh token. Called once the introspect request is validated. This method should verify the *token* and eit

Invalidate an authorization code after use. :param client_id: Unicode client identifier. :param code: The authorization code grant (r

Invalidates a used request token. :param client_key: The client/consumer key. :param request_token: The request token string.

Parse an OAuth authorization header into a list of 2-tuples

A unicode-safe version of urllib2.parse_http_list

A unicode-safe version of urllib2.parse_keqv_list

Abstract method used to parse redirection responses.

Add attributes from an auth code response to self.