# Attesto v2.0.1 - Table of Contents

> Vendor-neutral OAuth2/OIDC engine for Elixir with DPoP, mTLS, and PKCE sender-constraint support.

## Pages

- [Attesto](readme.md)

- Changelog
  - [Changelog](changelog.md)

- Contributing
  - [Contributing](contributing.md)

- License
  - [LICENSE](license.md)

## Modules

- [Attesto](Attesto.md): A vendor-neutral OAuth 2.0 / OIDC authorization-server and
resource-server engine.
- [Attesto.AuthorizationRequest](Attesto.AuthorizationRequest.md): Authorization endpoint request validation (RFC 6749 §4.1.1, OIDC Core
§3.1.2.1, RFC 7636 §4.3).
- [Attesto.CIBA](Attesto.CIBA.md): OpenID Connect Client-Initiated Backchannel Authentication (CIBA Core 1.0) -
the conn-free core.
- [Attesto.CIBA.Grant](Attesto.CIBA.Grant.md): The validated context a successfully redeemed CIBA authentication request
yields (CIBA Core §10.1).
- [Attesto.CIBA.Request](Attesto.CIBA.Request.md): A validated CIBA backchannel authentication request (CIBA Core §7.1).
- [Attesto.CIBAStore](Attesto.CIBAStore.md): Storage seam for the OpenID Connect CIBA grant
(`urn:openid:params:grant-type:ciba`).
- [Attesto.CIBAStore.ETS](Attesto.CIBAStore.ETS.md): Single-node ETS implementation of `Attesto.CIBAStore`.
- [Attesto.CNonceStore](Attesto.CNonceStore.md): Storage seam for server-issued OID4VCI c_nonces.
- [Attesto.CNonceStore.ETS](Attesto.CNonceStore.ETS.md): Single-node ETS implementation of `Attesto.CNonceStore`.
- [Attesto.Claims](Attesto.Claims.md): Shared mechanics for portable persisted claims, claim-key normalization,
and registered-claim merging.
- [Attesto.ClientAssertion](Attesto.ClientAssertion.md): `private_key_jwt` client authentication verification (RFC 7523 / OIDC Core).
- [Attesto.ClientIdMetadata](Attesto.ClientIdMetadata.md): Client ID Metadata Documents - CIMD
(`draft-ietf-oauth-client-id-metadata-document-01`, IETF OAuth WG).
- [Attesto.Cose](Attesto.Cose.md): Minimal COSE helpers for ISO 18013-5 issuer authentication.
- [Attesto.CredentialIssuerMetadata](Attesto.CredentialIssuerMetadata.md): OID4VCI Credential Issuer Metadata
(`draft-ietf-oauth-openid4vci` §11.2).
- [Attesto.CredentialOffer](Attesto.CredentialOffer.md): OID4VCI Credential Offer (`draft-ietf-oauth-openid4vci` §4.1).
- [Attesto.CredentialOfferStore](Attesto.CredentialOfferStore.md): Storage seam for by-reference OID4VCI credential offers.
- [Attesto.CredentialOfferStore.ETS](Attesto.CredentialOfferStore.ETS.md): Single-node ETS implementation of `Attesto.CredentialOfferStore`.
- [Attesto.CredentialProof](Attesto.CredentialProof.md): OID4VCI credential-request key proof of type `jwt`
(draft-ietf-oauth-openid4vci §8.2.1.1).
- [Attesto.CredentialRequest](Attesto.CredentialRequest.md): OID4VCI Credential Request (`draft-ietf-oauth-openid4vci` §8.2).
- [Attesto.CredentialResponse](Attesto.CredentialResponse.md): OID4VCI Credential Response (`draft-ietf-oauth-openid4vci` §8.3).
- [Attesto.DeviceCode](Attesto.DeviceCode.md): RFC 8628 Device Authorization Grant — the conn-free core.
- [Attesto.DeviceCode.Grant](Attesto.DeviceCode.Grant.md): The validated context a successfully redeemed device code yields
(RFC 8628 §3.4).
- [Attesto.DeviceCodeStore](Attesto.DeviceCodeStore.md): Storage seam for the RFC 8628 device authorization grant.
- [Attesto.DeviceCodeStore.ETS](Attesto.DeviceCodeStore.ETS.md): Single-node ETS implementation of `Attesto.DeviceCodeStore`.
- [Attesto.EndSession](Attesto.EndSession.md): Validate an OpenID Connect RP-Initiated Logout request
(OpenID Connect RP-Initiated Logout 1.0 §2-3).
- [Attesto.Federation.EntityStatement](Attesto.Federation.EntityStatement.md): Build and verify OpenID Federation 1.0 Entity Statements.
- [Attesto.Federation.MetadataPolicy](Attesto.Federation.MetadataPolicy.md): OpenID Federation 1.0 metadata-policy resolution and application.
- [Attesto.Federation.TrustChain](Attesto.Federation.TrustChain.md): Validate an already-resolved OpenID Federation 1.0 Trust Chain.
- [Attesto.Federation.TrustMark](Attesto.Federation.TrustMark.md): Verify an OpenID Federation 1.0 Trust Mark JWT.
- [Attesto.FrontChannelLogout](Attesto.FrontChannelLogout.md): OpenID Connect Front-Channel Logout 1.0 — the OP-side logout-URI builder.
- [Attesto.Introspection](Attesto.Introspection.md): OAuth 2.0 Token Introspection (RFC 7662), conn-free core.
- [Attesto.JARM](Attesto.JARM.md): JWT Secured Authorization Response Mode (JARM).
- [Attesto.JwtVc](Attesto.JwtVc.md): W3C Verifiable Credentials Data Model 1.1 credentials encoded as JWTs,
corresponding to the OID4VCI `jwt_vc_json` Credential Format.
- [Attesto.KeyAttestation](Attesto.KeyAttestation.md): OID4VCI Key Attestation in JWT format (OpenID4VCI 1.0 draft 15/ID2,
"Key Attestation in JWT format" §D.1, `#keyattestation-jwt`).
- [Attesto.LogoutSessionStore](Attesto.LogoutSessionStore.md): Storage seam for OpenID Connect Back-Channel Logout 1.0 and Front-Channel
Logout 1.0.
- [Attesto.LogoutToken](Attesto.LogoutToken.md): Mint OpenID Connect Back-Channel Logout `logout_token`s
(OpenID Connect Back-Channel Logout 1.0 §2.4).
- [Attesto.MapParams](Attesto.MapParams.md): Shared helpers for reading and validating protocol map parameters.
- [Attesto.Mdoc](Attesto.Mdoc.md): Issue and verify ISO 18013-5 mdoc credentials and OID4VP mdoc
presentations.
- [Attesto.NumericDate](Attesto.NumericDate.md): Value-level helpers for JWT NumericDate comparisons and Unix-second clocks.
- [Attesto.OpenIDDiscovery](Attesto.OpenIDDiscovery.md): OpenID Connect Discovery 1.0 - OpenID Provider Metadata (§3).
- [Attesto.PreAuthorizedCode](Attesto.PreAuthorizedCode.md): OID4VCI pre-authorized code issuance and redemption.
- [Attesto.PreAuthorizedCodeStore](Attesto.PreAuthorizedCodeStore.md): Storage seam for OID4VCI pre-authorized codes.
- [Attesto.PreAuthorizedCodeStore.ETS](Attesto.PreAuthorizedCodeStore.ETS.md): Single-node ETS implementation of `Attesto.PreAuthorizedCodeStore`.
- [Attesto.PresentationRequest](Attesto.PresentationRequest.md): OID4VP Authorization Request (`draft-ietf-oauth-openid4vp` §5).
- [Attesto.PresentationSession](Attesto.PresentationSession.md): Verifier-side OID4VP presentation-session state machine.
- [Attesto.PresentationSessionStore](Attesto.PresentationSessionStore.md): Storage seam for verifier-side OID4VP presentation sessions.
- [Attesto.PresentationSessionStore.ETS](Attesto.PresentationSessionStore.ETS.md): Single-node ETS implementation of `Attesto.PresentationSessionStore`.
- [Attesto.ProtectedResourceMetadata](Attesto.ProtectedResourceMetadata.md): RFC 9728 - OAuth 2.0 Protected Resource Metadata.
- [Attesto.RedirectURI](Attesto.RedirectURI.md): Redirect-URI matching for the authorization endpoint (RFC 6749 §3.1.2.3,
RFC 8252 §7.3).
- [Attesto.RequestObject](Attesto.RequestObject.md): Signed OpenID Connect Request Object verification (JAR, RFC 9101 / OIDC §6.1).
- [Attesto.RequestObject.Policy](Attesto.RequestObject.Policy.md): Verification policy for signed authorization request objects (JAR, RFC 9101).
- [Attesto.ResourceIndicator](Attesto.ResourceIndicator.md): RFC 8707 Resource Indicators for OAuth 2.0 — the conn-free primitive.
- [Attesto.SdJwt](Attesto.SdJwt.md): Selective Disclosure for JWTs (SD-JWT), draft-ietf-oauth-selective-disclosure-jwt.
- [Attesto.SdJwtVc](Attesto.SdJwtVc.md): SD-JWT-based Verifiable Credentials (SD-JWT VC), draft-ietf-oauth-sd-jwt-vc.
- [Attesto.SessionState](Attesto.SessionState.md): OpenID Connect Session Management 1.0 — the `session_state` value.
- [Attesto.SignedIntrospection](Attesto.SignedIntrospection.md): JWT response for OAuth 2.0 Token Introspection (RFC 9701).
- [Attesto.SigningAlg](Attesto.SigningAlg.md): Key-derived JOSE signing algorithm helpers.
- [Attesto.StatusList](Attesto.StatusList.md): IETF Token Status List construction and verification.
- [Attesto.StatusListStore](Attesto.StatusListStore.md): Storage seam for issuer-managed Token Status Lists.
- [Attesto.StatusListStore.ETS](Attesto.StatusListStore.ETS.md): Single-node ETS implementation of `Attesto.StatusListStore`.
- [Attesto.StepUp](Attesto.StepUp.md): RFC 9470 Step-Up Authentication Challenge — the conn-free core primitive.
- [Attesto.StepUp.Requirement](Attesto.StepUp.Requirement.md): A normalized RFC 9470 step-up authentication requirement for a protected route.
- [Attesto.VpToken](Attesto.VpToken.md): OID4VP `vp_token` verification for SD-JWT VC (`dc+sd-jwt`) and ISO mdoc
(`mso_mdoc`) presentations (OID4VP §7).
- [Attesto.WalletAttestation](Attesto.WalletAttestation.md): OAuth 2.0 Attestation-Based Client Authentication
(`draft-ietf-oauth-attestation-based-client-auth-10`, 2026-07-06), the
"Wallet Attestation" client authentication method OID4VCI recommends for
native-app Wallets in place of `private_key_jwt`/mTLS.

- Core
  - [Attesto.Config](Attesto.Config.md): Immutable configuration a token operation runs against.
  - [Attesto.IDToken](Attesto.IDToken.md): Mint and verify OpenID Connect ID Tokens (OpenID Connect Core 1.0 §2).
  - [Attesto.PrincipalKind](Attesto.PrincipalKind.md): One kind of subject a token can describe.
  - [Attesto.Siop](Attesto.Siop.md): SIOPv2 Self-Issued ID Token verification for the Relying Party role.
  - [Attesto.Token](Attesto.Token.md): Mint and verify JWT access tokens with trusted, key-bound algorithms.

- Grants
  - [Attesto.AuthorizationCode](Attesto.AuthorizationCode.md): RFC 6749 §4.1 authorization-code grant, with mandatory PKCE (RFC 7636,
S256) and optional DPoP binding of the code (RFC 9449 §10).
  - [Attesto.AuthorizationCode.Grant](Attesto.AuthorizationCode.Grant.md): The validated context a successfully redeemed authorization code yields.
  - [Attesto.IdentityAssertion](Attesto.IdentityAssertion.md): Identity Assertion JWT Authorization Grant (ID-JAG) verification - the resource
Authorization Server's half of the Identity Assertion Authorization Grant
(`draft-ietf-oauth-identity-assertion-authz-grant-04`), the grant behind MCP
Enterprise-Managed Authorization (EMA).
  - [Attesto.PKCE](Attesto.PKCE.md): RFC 7636 - Proof Key for Code Exchange (PKCE).
  - [Attesto.RefreshToken](Attesto.RefreshToken.md): Refresh-token issuance and rotation with reuse detection
(RFC 6749 §6 / §10.4, OAuth 2.0 Security BCP).
  - [Attesto.Revocation](Attesto.Revocation.md): RFC 7009 - OAuth 2.0 Token Revocation, for refresh tokens.

- Plugs
  - [Attesto.Plug.Authenticate](Attesto.Plug.Authenticate.md): Authenticate a protected-resource request: verify the access token and,
for a DPoP-bound or mTLS-bound token, the sender-constraint proof.
  - [Attesto.Plug.OAuthError](Attesto.Plug.OAuthError.md): Render the RFC 6750 / RFC 9449 error responses for the Attesto plugs.
  - [Attesto.Plug.RequireScopes](Attesto.Plug.RequireScopes.md): Authorize a request against the scopes on the verified token.

- Stores
  - [Attesto.CodeStore](Attesto.CodeStore.md): Storage seam for authorization codes.
  - [Attesto.CodeStore.ETS](Attesto.CodeStore.ETS.md): Single-node ETS implementation of `Attesto.CodeStore`.
  - [Attesto.DPoP.NonceStore](Attesto.DPoP.NonceStore.md): Storage seam for server-issued DPoP nonces (RFC 9449 §8).
  - [Attesto.DPoP.NonceStore.ETS](Attesto.DPoP.NonceStore.ETS.md): Single-node ETS implementation of `Attesto.DPoP.NonceStore`.
  - [Attesto.RefreshStore](Attesto.RefreshStore.md): Storage seam for refresh tokens, with the atomic primitive that makes
reuse detection possible.
  - [Attesto.RefreshStore.ETS](Attesto.RefreshStore.ETS.md): Single-node ETS implementation of `Attesto.RefreshStore`.

- Sender-constraint
  - [Attesto.DPoP](Attesto.DPoP.md): RFC 9449 - OAuth 2.0 Demonstrating Proof of Possession (DPoP).
  - [Attesto.DPoP.ReplayCache](Attesto.DPoP.ReplayCache.md): In-memory, TTL-bounded cache of seen DPoP proof `jti` values.
  - [Attesto.MTLS](Attesto.MTLS.md): RFC 8705 - OAuth 2.0 Mutual-TLS Client Authentication and
Certificate-Bound Access Tokens.

- Scopes
  - [Attesto.Scope](Attesto.Scope.md): Scope grant-form matching for OAuth-style `<resource>.<action>` scopes.

- Metadata
  - [Attesto.Discovery](Attesto.Discovery.md): RFC 8414 - OAuth 2.0 Authorization Server Metadata.
  - [Attesto.JWKS](Attesto.JWKS.md): RFC 7517 - publish the signing keys' public halves as a JWK Set.

- Keys
  - [Attesto.Did](Attesto.Did.md): Connection-free resolution for self-contained DID methods.
  - [Attesto.Key](Attesto.Key.md): Pure helpers for working with signing material as PEM strings.
  - [Attesto.Keystore](Attesto.Keystore.md): The behaviour Attesto uses to obtain signing and verification keys.
  - [Attesto.Keystore.Static](Attesto.Keystore.Static.md): A simple `Attesto.Keystore` backed by application configuration.
  - [Attesto.Signer](Attesto.Signer.md): Additive signing contract for non-extractable private keys.

- Observability
  - [Attesto.Telemetry](Attesto.Telemetry.md): `:telemetry` events Attesto emits for security-relevant refusals.

- Shared
  - [Attesto.ClusterGuard](Attesto.ClusterGuard.md): Refuse to start a per-node ETS store on a clustered BEAM.
  - [Attesto.Secret](Attesto.Secret.md): Generate and hash the opaque secrets that back stateful grants.
  - [Attesto.SecureCompare](Attesto.SecureCompare.md): Result-independent comparison of two binaries.
  - [Attesto.Thumbprint](Attesto.Thumbprint.md): Canonical SHA-256 thumbprint shape, shared across the sender-constraint
schemes.

- Testing
  - [Attesto.Test.DPoP](Attesto.Test.DPoP.md): DPoP test fixtures for host application suites.
  - [Attesto.Test.DPoPVerifier](Attesto.Test.DPoPVerifier.md): Server-side DPoP verification harness for host application test suites.