Package: shinyOAuth 0.7.0

Overview | Provider metadata and OIDC discovery | JWT client authentication | Mutual TLS (mTLS) | Pushed authorization requests (PAR) | JWT-secured authorization request (JAR) | Form Post response mode | JWT-secured authorization response mode (JARM) | Demonstrating proof-of-possession (DPoP) | Browser binding and deployment boundary | Endpoint-specific authentication | Certificate binding and platform requirements | Testing signed-request enforcement | Request Objects published by the Shiny app | Deployment behind an HTTPS proxy | Encrypted authorization responses | Token binding requirements and validation | DPoP in API requests | Policy identity across callbacks and retained credentials | Issuer comparison and transport policy | Callback pages and application scripts | Provider key-set validation | Trusted ID-token audiences | Signature and encryption support

Overview | Receiving audit events | Authentication outcomes | Event structure | HTTP context and redaction | Audit events from asynchronous workers | Digest keys across R processes | Event catalog | Login and callbacks | Tokens and profiles | Sessions and saved connections | Error records

Overview | Starting login and binding it to the browser | Preparing the authorization request | Pending state and expiry | Authorization at the provider | Receiving and validating the callback | Transaction checks | Several authorization servers | Exchanging the code for tokens | Validating identity and profile information | ID token checks | Introspection and UserInfo | Publishing authentication state | Asynchronous execution | Refresh, reauthentication and logout | Token refresh | Expiry and maximum login age | Logout and revocation | Optional protocol extensions | Audit trail

Overview | Spotify app registration | Shiny app example | API requests and scopes | Full dashboard example

Why keep several authorizations? | Client configuration and connections | Register two clients | 1. Configure clients outside server() | 2. Keep authorizations when the browser returns | 3. Select a connection and make a request | Requests, permissions and refresh | Disconnecting a service | Deployment notes | Keep an ordinary OIDC login alongside SMART connections

Overview | Exporter configuration | Traces and event correlation | Logging and tracing options | Protecting diagnostic data | Authorization metadata privacy | Asynchronous workers | Advanced diagnostic fields | Error attributes and redaction | Span catalog

What package options are for | Set an option at app startup | Logging | HTTP settings (timeout, retries, user agent) | Async timeout (mirai) | Async condition replay | Token lifetime fallback | Validation and URL policy | State store | Size caps | State envelope | Callback query | Configuration assessments | Local debugging | Advanced transport constraints | Advanced parameter overrides

Overview | Provider, client, and token objects | GitHub app registration | Minimal Shiny module example | Authentication state and user information | Manual login and logout buttons | Authenticated API requests | Asynchronous execution | Token expiry and session length | Provider configuration and OIDC discovery | Deployment | Callback and browser behavior | Advanced deployment | Posit Connect and Connect Cloud | Multiple R processes | Local Keycloak development | Further configuration

One login, different API tokens | Configure two APIs | Choose a token when making a call | Refresh and sign in again | Microsoft example | Advanced: provider support and declaration limits | Identity and refresh-consent scopes | Advanced: Microsoft permissions and consent | Resource identifiers and scope names | Static permissions and unusual short names | Advanced: concurrent refreshes and failures | Request customization and background work

FHIR and SMART on FHIR | Before running the example | 1. Discover the server and configure the client | 2. Configure retained connections | 3. Authorize and fetch the patient | Search with the same connection | Patient context and user identity are different | Start from an EHR instead | More than one hospital | Other registration and refresh options | Granular permissions and refresh

Reuse a login in another package | A complete Shiny example | Refresh and signing in again | SDK token callbacks and database drivers | Several accounts and optional profile retrieval | Advanced: connection lifetime and permissions | Reducing permissions and replacing a login | Advanced: asynchronous token acquisition | Handling token errors | Advanced: background tasks and saved results