A malleable representation of a signable HTTP request. Body argument may contain any data, but parameters will only be decoded if they are on

A client used to sign OAuth 1.0 RFC 5849 requests.

Base OAuth2 client responsible for access token management. This class also acts as a generic interface providing methods common to all clien

Mock of client credentials used by the sign_*_with_client functions. For HMAC, set the client_secret and resource_owner_secret. For RSA

A validator/datastore interaction base class for OAuth 1 providers. OAuth providers should inherit from RequestValidator and implement the me

Mock of a request used by the verify_* functions.

`Authorization Code Grant`_ The authorization code grant type is used to obtain both access tokens and refresh tokens and is optimized for co

A client utilizing the authorization code grant workflow. A web application is a confidential client running on a web server. Resource owner

`Implicit Grant`_ The implicit grant type is used to obtain access tokens (it does not support the issuance of refresh tokens) and is optimiz

OAuth2.0 Authorization Server Metadata endpoint. This specification generalizes the metadata format defined by `OpenID Connect Discovery 1.0` i

`Refresh token grant`_ .. _`Refresh token grant`: https://tools.ietf.org/html/rfc6749#section-6

`Resource Owner Password Credentials Grant`_ The resource owner password credentials grant type is suitable in cases where the resource owner

An all-in-one endpoint featuring all four major grant types and extension grants.

`Client Credentials Grant`_ The client can request an access token using only its client credentials (or other supported means of authenticat

The request is missing a required parameter, includes an invalid parameter value, includes a parameter more than once, or is otherwise ma

An all-in-one endpoint featuring Authorization code grant and Bearer tokens.

An all-in-one endpoint featuring Implicit code grant and Bearer tokens.

Fixture for testing list_to_scope()/scope_to_list() with objects other than regular strings.

Token issuing endpoint. The token endpoint is used by the client to obtain an access token by presenting its authorization grant or refresh t

An all-in-one endpoint featuring Client Credentials grant and Bearer tokens.

An all-in-one endpoint featuring Resource Owner Password Credentials grant and Bearer tokens.

Token revocation endpoint. Endpoint used by authenticated clients to revoke access and refresh tokens. Commonly this will be part of the Auth

Authorization endpoint - used by the client to obtain authorization from the resource owner via user-agent redirection. The authorization end

This is an adapter class that will route simple Token requests, those that authorization_code have a scope including 'openid' to either the d

Basic case insensitive dict with strings only keys.

A public client utilizing the device authorization workflow. The client can request an access token using a device code and a public client i

Introspect token endpoint. This endpoint defines a method to query an OAuth 2.0 authorization server to determine the active state of an OAuth

A public client utilizing the client credentials grant workflow. The client can request an access token using only its client credentials (or

An all-in-one endpoint featuring Authorization code grant and Bearer tokens.

A public client using the resource owner password and username directly. The resource owner password credentials grant type is suitable in ca

A public client utilizing the implicit code grant workflow. A user-agent-based application is a public client in which the client code is dow

A public client utilizing the JWT bearer grant. JWT bearer tokes can be used to request an access token when a client wishes to utilize an ex

This is an adapter class that will route simple Authorization requests, those that have `id_token` in `response_type` and a scope includi

Client authentication failed (e.g. unknown client, no client authentication included, or unsupported authentication method). The authoriz

The Authorization Server requires End-User authentication. This error MAY be returned when the prompt parameter value in the Authenticat

An endpoint responsible for providing OAuth 1 request tokens. Typical use is to instantiate with a request validator and invoke the ``create_

Authorizes access to protected resources. The client accesses protected resources by presenting the access token to the resource server. The

The authorization request was denied.

An endpoint responsible for providing OAuth 1 access tokens. Typical use is to instantiate with a request validator and invoke the ``create_a

This is an adapter class that will route simple Authorization Code requests, those that have `response_type=code` and a scope including `

For the device authorization grant; The authorization request is still pending as the end user hasn't yet completed the user-interact

The Authorization Server requires End-User consent. This error MAY be returned when the prompt parameter value in the Authentication Req

This error is a placeholder for all custom errors not described by the RFC. Some of the popular OAuth2 providers are using custom errors.

DeviceAuthorization endpoint - used by the client to initiate the authorization flow by requesting a set of verification codes from the author

Errors during authorization where user should not be redirected back. If the request fails due to a missing, invalid, or mismatching red

Class to test GrantTypeBase

The authorization server encountered an unexpected condition that prevented it from fulfilling the request. (This error code is needed b

An endpoint only responsible for verifying an oauth signature.

The authorization server is currently unable to handle the request due to a temporary overloading or maintenance of the server. (This err

The authorization server does not support the hint of the presented token type. I.e. the client tried to revoke an access token on a ser

Authorizes access to userinfo resource.

Container object for holding custom validator callables to be invoked as part of the grant type `validate_authorization_request()` or `va

If blinker is unavailable, create a fake class with the same interface that allows sending of signals but will fail with an error on a

The resource owner or authorization server denied the request.

The End-User is REQUIRED to select a session at the Authorization Server. The End-User MAY be authenticated at the Authorization Server with

An endpoint responsible for letting authenticated users authorize access to their protected resources to a client. Typical use would be to ha