Gateway-owned authentication lifecycle shared by MCP and model adapters.
start! takes an owner [domain id] and protocol legs :start (0-arg),
:complete (private flow, input), :await (private flow), :settle (0-arg).
Start returns :kind, private :flow, and allowlisted presentation fields.
An adapter doing dynamic registration can allocate callback-transport!
before constructing its authorization URL; all other adapters let us do it.
One live attempt per owner. All completion paths serialize on the same state; terminal verdicts remain pollable until expiry/cancellation. Private flow data and adapter results never cross the public allowlist. No browser or relay here. Cancellation stops workers and rejects late verdicts; adapters must also obey interruption/expiry before persisting credentials during an in-flight exchange.
Gateway-owned authentication lifecycle shared by MCP and model adapters. `start!` takes an owner `[domain id]` and protocol legs `:start` (0-arg), `:complete` (private flow, input), `:await` (private flow), `:settle` (0-arg). Start returns `:kind`, private `:flow`, and allowlisted presentation fields. An adapter doing dynamic registration can allocate `callback-transport!` before constructing its authorization URL; all other adapters let us do it. One live attempt per owner. All completion paths serialize on the same state; terminal verdicts remain pollable until expiry/cancellation. Private flow data and adapter results never cross the public allowlist. No browser or relay here. Cancellation stops workers and rejects late verdicts; adapters must also obey interruption/expiry before persisting credentials during an in-flight exchange.
(callback-transport! mode redirect state ttl-ms)Allocate only a registered loopback or Vis app callback. Returns public mode/URI
plus private :callback. Dynamic registration must use the returned URI for both
authorization and exchange, and stop the receiver if preparation fails.
Allocate only a registered loopback or Vis app callback. Returns public mode/URI plus private `:callback`. Dynamic registration must use the returned URI for both authorization and exchange, and stop the receiver if preparation fails.
(cancel! domain id)Idempotently forget this domain's flow and stop its listener/worker.
Idempotently forget this domain's flow and stop its listener/worker.
(cancel-owner! owner)Stop every attempt for this exact domain/subject, including on logout.
Stop every attempt for this exact domain/subject, including on logout.
(complete! domain id input)Validate and spend a callback/key once. Failed manual input remains retryable.
Validate and spend a callback/key once. Failed manual input remains retryable.
(poll! domain id)Read the same retained verdict for browser, app and device flows, without blocking.
Read the same retained verdict for browser, app and device flows, without blocking.
(start! owner {:keys [start complete await settle]})Start one adapter through the common lifecycle. Returns only a public result. Domain scopes prevent one API's completion/cancel route from spending another's flow.
Start one adapter through the common lifecycle. Returns only a public result. Domain scopes prevent one API's completion/cancel route from spending another's flow.
cljdoc builds & hosts documentation for Clojure/Script libraries
| Ctrl+k | Jump to recent docs |
| ← | Move to previous article |
| → | Move to next article |
| Ctrl+/ | Jump to the search field |