Normalized claims extracted from a validated OIDC JWT.
Validated protocol evidence only; does not establish session ownership or perform logout.
Application-scoped route and callback configuration.
Small OIDC client for authorization-code-with-PKCE application flows.
Explicit per-request target; never mutates the browser's login session or another tab's context.
Raw token response returned by an OIDC tenant.
Client authentication capability, independent of private-key storage and the HTTP transport.
Credentials used by a confidential application when exchanging an authorization code.
OIDC discovery metadata used by Fluxzero application authentication helpers.
Stateless BFF login transaction data for one OIDC Authorization Code + PKCE attempt.
Tenant-specific OIDC settings for a Fluxzero application.
Client authentication method used at the OIDC token endpoint.
In-process HTTP boundary for OIDC protocol calls.
PKCE verifier and S256 challenge pair.
Parameters for validating an ID or access token against a configured OIDC tenant.
Strategy for validating OIDC JWTs.