OAuth2 Implementation

OAuth2 Implementation

Complete OAuth2 server/client with authorization code, PKCE, client credentials, and token refresh flows. Zero dependencies.

Part of the Auth Vault toolkit by [CodeVault](https://codevault.dev).

Features

• Authorization Code Grant with PKCE support (RFC 7636)
• Client Credentials Grant for machine-to-machine authentication
• Token refresh with automatic rotation and revocation
• CSRF protection via cryptographic state parameter
• Scope-based authorization with consent flow
• Configurable token expiration and signing (HMAC-SHA256)
• In-memory token store with JSON persistence
• CLI tool for server, client, and token management
• Zero dependencies — Python stdlib only

Quick Start

# Start the OAuth2 authorization server
python3 src/main.py serve --port 8080

# Register a new client
python3 src/main.py register --name "My App" \
    --redirect-uri https://app.example.com/callback \
    --scopes read write

# Generate a PKCE challenge
python3 src/main.py pkce

# Exchange an authorization code for tokens
python3 src/main.py exchange --code AUTH_CODE --verifier PKCE_VERIFIER

# Validate a token
python3 src/main.py validate --token ACCESS_TOKEN

Using as a Library

from main import OAuth2Server, OAuth2Client, PKCEChallenge

# Server setup
server = OAuth2Server(signing_secret="your-secret-here")
client_id, client_secret = server.register_client(
    name="My App",
    redirect_uris=["https://app.example.com/callback"],
    scopes=["read", "write"],
)

# PKCE flow (client side)
pkce = PKCEChallenge.generate()
auth_url = client.build_authorization_url(
    client_id=client_id,
    redirect_uri="https://app.example.com/callback",
    scopes=["read", "write"],
    code_challenge=pkce.challenge,
)

*... continues with setup instructions, usage examples, and more.*