# @askrjs/auth/oidc

> Published API exports for @askrjs/auth/oidc.

Source: [https://askrjs.com/docs/reference/api/auth/oidc](https://askrjs.com/docs/reference/api/auth/oidc)

Status: stable. Packages: @askrjs/auth/oidc.

**Published packages are authoritative.** Examples may lag behind a published contract. When guidance differs, verify the exports and TypeScript declarations in your installed package, then file an issue.

## Exports

This entrypoint publishes 11 exports from the declarations shipped by @askrjs/auth.

### `createOidcClient`

```ts
createOidcClient: (options: OidcClientOptions) => OidcClient
```

Create an OIDC client with discovery caching and ID-token validation.

### `OidcAuthorizationRequest`

```ts
OidcAuthorizationRequest: any
```

Generated authorization URL and callback values.

- `url`: Provider authorization URL.

- `state`: CSRF state value.

- `nonce`: Replay-protection nonce.

- `codeVerifier`: PKCE verifier retained for callback exchange.

### `OidcAuthorizationRequestOptions`

```ts
OidcAuthorizationRequestOptions: any
```

Optional state, nonce, and PKCE values for an authorization request.

- `state`: CSRF state value.

- `nonce`: Replay-protection nonce.

- `codeVerifier`: PKCE verifier.

- `loginHint`: Optional provider login hint.

### `OidcClient`

```ts
OidcClient: any
```

High-level OIDC discovery, authorization, and callback client.

- `discover`: Discover and cache provider metadata.

- `createAuthorizationRequest`: Build an authorization URL and callback state.

- `exchangeCode`: Exchange an authorization code and validate its ID token.

### `OidcClientError`

```ts
OidcClientError: typeof OidcClientError
```

Error raised while discovering, exchanging, or validating OIDC tokens.

- `code`: Error category used for programmatic handling.

- `name`: Error category used for programmatic handling.

### `OidcClientErrorCode`

```ts
OidcClientErrorCode: "discovery-failed" | "invalid-metadata" | "state-mismatch" | "exchange-failed" | "invalid-token-response" | "invalid-id-token"
```

Stable failure codes for OIDC client operations.

### `OidcClientOptions`

```ts
OidcClientOptions: any
```

Client credentials and callback settings for OIDC.

- `issuer`: Provider issuer URL.

- `clientId`: Registered client identifier.

- `clientSecret`: Optional confidential-client secret.

- `redirectUri`: Registered redirect URI.

- `scopes`: Requested scopes.

- `fetch`: Fetch implementation for provider requests.

### `OidcCodeExchange`

```ts
OidcCodeExchange: any
```

Callback code and original authorization request values.

- `code`: Authorization code.

- `state`: Returned CSRF state.

- `request`: Stored authorization request values.

### `OidcCodeExchangeResult`

```ts
OidcCodeExchangeResult: any
```

Result of exchanging an authorization code.

- `tokens`: Provider tokens.

- `principal`: Principal derived from the validated ID token.

### `OidcProviderMetadata`

```ts
OidcProviderMetadata: any
```

Discovery metadata published by an OpenID Connect provider.

- `issuer`: Provider issuer URL.

- `authorization_endpoint`: Authorization endpoint URL.

- `token_endpoint`: Token endpoint URL.

- `jwks_uri`: JWKS endpoint URL.

- `userinfo_endpoint`: Optional user-info endpoint URL.

- `end_session_endpoint`: Optional end-session endpoint URL.

### `OidcTokenResponse`

```ts
OidcTokenResponse: any
```

Token response returned by an OIDC provider.

- `access_token`: Access token.

- `token_type`: Token type, normally Bearer.

- `id_token`: Optional ID token.

- `refresh_token`: Optional refresh token.

- `expires_in`: Optional lifetime in seconds.

## Documentation navigation

[Previous](https://askrjs.com/docs/reference/api/auth/jwt/index.md) | [Next](https://askrjs.com/docs/reference/api/auth/saml/index.md)