Model-provider adapter to the shared gateway authentication lifecycle in flow.
Registered providers own protocol start/complete/await and credential persistence;
flow owns callback transport, expiry, cancellation, single exchange and verdicts.
This adapter handles provider eligibility, API-key storage and fleet invalidation.
No browser, relay, token or PKCE verifier crosses the public flow view.
Model-provider adapter to the shared gateway authentication lifecycle in `flow`. Registered providers own protocol start/complete/await and credential persistence; `flow` owns callback transport, expiry, cancellation, single exchange and verdicts. This adapter handles provider eligibility, API-key storage and fleet invalidation. No browser, relay, token or PKCE verifier crosses the public flow view.
(cancel-auth! flow-id)Forget a provider flow and stop its callback/device worker. Idempotent.
Forget a provider flow and stop its callback/device worker. Idempotent.
(complete-auth! flow-id input)Complete a provider flow through the same callback validation and exchange as MCP.
Complete a provider flow through the same callback validation and exchange as MCP.
(logout! provider-id)Clear provider-id's persisted credentials, then invalidate the cached fleet so
status flips on the next read.
Two shapes of credential:
:logout (OAuth/device providers) revokes the session;The CONFIG ENTRY always survives — logging out forgets the credential, never the
provider's models/base-url. Returning :auth-unsupported for key providers made
the gateway answer 400 and channels surface an ordinary logout as a fatal error.
Clear `provider-id`'s persisted credentials, then invalidate the cached fleet so status flips on the next read. Two shapes of credential: - a registered `:logout` (OAuth/device providers) revokes the session; - everything else is an API key, which is cleared from the config entry. The CONFIG ENTRY always survives — logging out forgets the credential, never the provider's models/base-url. Returning `:auth-unsupported` for key providers made the gateway answer 400 and channels surface an ordinary logout as a fatal error.
(poll-auth! flow-id)Read a retained browser/device verdict without blocking.
Read a retained browser/device verdict without blocking.
(self-minted? provider-id)True when configuration mints this provider's credential itself (an
api_key_command helper). There is no key for a human to collect, so no
auth flow may be offered for it — a key typed into a dialog would silently
outrank the helper on the next request.
True when configuration mints this provider's credential itself (an `api_key_command` helper). There is no key for a human to collect, so no auth flow may be offered for it — a key typed into a dialog would silently outrank the helper on the next request.
(start-auth! provider-id)Begin headless auth for provider-id. Returns {:ok? true :flow {…}} with
the public flow view, or {:ok? false :error kw :message str}.
THREE kinds, ONE wire shape, so a client never special-cases a provider:
pkce uses the adapter's registered callback transport and accepts complete-auth!;
device starts its background await; api-key asks the client to collect a
key and hand it back to complete-auth!. Even plain key providers
are persisted BY THE DAEMON, never by the calling process.
Begin headless auth for `provider-id`. Returns `{:ok? true :flow {…}}` with
the public flow view, or `{:ok? false :error kw :message str}`.
THREE kinds, ONE wire shape, so a client never special-cases a provider:
`pkce` uses the adapter's registered callback transport and accepts `complete-auth!`;
`device` starts its background await; `api-key` asks the client to collect a
key and hand it back to `complete-auth!`. Even plain key providers
are persisted BY THE DAEMON, never by the calling process.(supported? provider-id)True when provider-id can be authenticated over the wire — OAuth (PKCE or
device) or a plain API key — as opposed to only through the interactive
terminal :provider/auth-fn.
True when `provider-id` can be authenticated over the wire — OAuth (PKCE or device) or a plain API key — as opposed to only through the interactive terminal `:provider/auth-fn`.
cljdoc builds & hosts documentation for Clojure/Script libraries
| Ctrl+k | Jump to recent docs |
| ← | Move to previous article |
| → | Move to next article |
| Ctrl+/ | Jump to the search field |