ai-elements-core/dev.ai.elements.core.auth/OAuthClient

OAuthClient

class OAuthClient(http: OkHttpClient = DefaultHttpClient)(source)

The network half of OAuth: build authorize URLs, exchange and refresh tokens, run the device flow. No Android dependencies, so it is unit-tested on the JVM against a local server. Tokens and codes never appear in exception messages.

Constructors

OAuthClient

constructor(http: OkHttpClient = DefaultHttpClient)

Types

Attempt

class Attempt

One authorization-code attempt: open url in the browser, then exchange.

Functions

begin

fun begin(flow: AuthorizationCodeFlow): OAuthClient.Attempt

exchange

suspend fun exchange(flow: AuthorizationCodeFlow, attempt: OAuthClient.Attempt, code: String): OAuthTokens

openRouterKey

suspend fun openRouterKey(keysUrl: String, code: String, attempt: OAuthClient.Attempt): String

OpenRouter's PKCE flow for apps: the result is an API key owned by the user (not a token), so it is stored like any other API key. See https://openrouter.ai/docs/use-cases/oauth-pkce.

pollDevice

suspend fun pollDevice(flow: DeviceCodeFlow, device: DeviceAuthorization): OAuthTokens

Polls until the user approves (RFC 8628 §3.5): waits on authorization_pending, backs off 5s on slow_down, fails on access_denied / expired_token or when the code expires.

refresh

suspend fun refresh(tokenUrl: String, clientId: String, clientSecret: String?, tokens: OAuthTokens, extraParams: Map<String, String> = emptyMap()): OAuthTokens

Exchanges the refresh token; keeps the old refresh token when the server doesn't rotate it.

startDevice

suspend fun startDevice(flow: DeviceCodeFlow): DeviceAuthorization