keys

Aug 25, 2026

Changes in this version

type Decrypter

+ func NewDecrypter(backends map[DecryptionPurpose]RecipientKey) (Decrypter, error)

+ func NewSingleKeyDecrypter(backend RecipientKey) (Decrypter, error)

+ type ECDHAgreer interface

+ AgreeSharedSecret func(ctx context.Context, keyID string, epk *ecdh.PublicKey) (z []byte, err error)

+ func NewInMemoryECDH(priv *ecdh.PrivateKey, kid string) (ECDHAgreer, error)

+ type KeyDecrypter interface

+ DecryptKey func(ctx context.Context, keyID string, alg fapi.KeyManagementAlgorithm, ...) (cek []byte, err error)

+ func NewInMemoryRSA(priv *rsa.PrivateKey, kid string) (KeyDecrypter, error)

type KeyManager

+ func NewKeyManagerFromSigners(signers map[SigningPurpose]crypto.Signer, ...) (KeyManager, error)

+ type RecipientKey interface

+ PublicKey func(ctx context.Context) (PublicKeyInfo, error)

+ type RotatingKeyManager interface

+ PublicKeys func(ctx context.Context, purpose SigningPurpose, algorithm fapi.SignatureAlgorithm) (SigningKeySet, error)

+ type SigningKeySet struct

+ Keys []PublicKeyInfo

type UnwrapRequest

+ KeyID string

Aug 24, 2026

Changes in this version

type DecryptionPurpose

+ const UserInfoDecryption

type IssuerVerificationPurpose

+ const UserInfoVerification

Aug 23, 2026

Changes in this version

type SigningRequest

+ SigningInput []byte

+ func NewSigningRequest(purpose SigningPurpose, algorithm fapi.SignatureAlgorithm, ...) SigningRequest

Aug 23, 2026

Changes in this version

+ type ClientEncryptionKey struct

+ Algorithm fapi.KeyManagementAlgorithm

+ KeyID string

+ PublicKey crypto.PublicKey

+ type ClientEncryptionKeyRequest struct

+ Algorithm fapi.KeyManagementAlgorithm

+ ClientID fapi.ClientID

+ KeyID string

+ Purpose ClientEncryptionPurpose

+ type ClientEncryptionKeySet struct

+ Keys []ClientEncryptionKey

+ type ClientEncryptionKeySource interface

+ ResolveEncryptionKeys func(ctx context.Context, req ClientEncryptionKeyRequest) (ClientEncryptionKeySet, error)

+ type ClientEncryptionPurpose uint8

+ const IDTokenEncryption

+ type Decrypter interface

+ EncryptionPublicKey func(ctx context.Context, purpose DecryptionPurpose, ...) (PublicKeyInfo, error)

+ UnwrapContentEncryptionKey func(ctx context.Context, req UnwrapRequest) ([]byte, error)

+ type DecryptionPurpose uint8

+ const IDTokenDecryption

+ type UnwrapRequest struct

+ Algorithm fapi.KeyManagementAlgorithm

+ EncryptedKey []byte

+ EphemeralPublicKey *ecdh.PublicKey

+ Purpose DecryptionPurpose

Aug 22, 2026

Changes in this version

type JWKSOption

+ func WithRefreshBackoff(d time.Duration) JWKSOption

Aug 22, 2026

Changes in this version

+ type JWKSOption func(*JWKSIssuerKeySource)

+ func WithMinRefreshInterval(d time.Duration) JWKSOption

Aug 20, 2026

Changes in this version

+ type ClientKeyRequest struct

+ Algorithm fapi.SignatureAlgorithm

+ ClientID fapi.ClientID

+ KeyID string

+ Purpose VerificationPurpose

+ type ClientKeySource interface

+ ResolveVerificationKeys func(ctx context.Context, req ClientKeyRequest) (VerificationKeySet, error)

+ type IssuerKey struct

+ Algorithm fapi.SignatureAlgorithm

+ KeyID string

+ PublicKey crypto.PublicKey

+ type IssuerKeyRequest struct

+ Algorithm fapi.SignatureAlgorithm

+ Issuer string

+ KeyID string

+ Purpose IssuerVerificationPurpose

+ type IssuerKeySet struct

+ Keys []IssuerKey

+ type IssuerKeySource interface

+ ResolveIssuerKeys func(ctx context.Context, req IssuerKeyRequest) (IssuerKeySet, error)

+ type IssuerVerificationPurpose uint8

+ const AccessTokenVerification

+ const IDTokenVerification

+ const JARMVerification

+ type JWKSIssuerKeySource struct

+ func NewJWKSIssuerKeySource(fetcher *fapihttp.Client, jwksURI fapi.URL, cacheTTL time.Duration) (*JWKSIssuerKeySource, error)

+ func (s *JWKSIssuerKeySource) ResolveIssuerKeys(ctx context.Context, req IssuerKeyRequest) (IssuerKeySet, error)

+ type KeyManager interface

+ PublicKey func(ctx context.Context, purpose SigningPurpose, algorithm fapi.SignatureAlgorithm) (PublicKeyInfo, error)

+ Sign func(ctx context.Context, req SigningRequest) (Signature, error)

+ type PublicKeyInfo struct

+ KeyID string

+ PublicKey crypto.PublicKey

+ type Signature struct

+ KeyID string

+ Value []byte

+ type SigningPurpose uint8

+ const AccessTokenSigning

+ const ClientAuthentication

+ const DPoPProofSigning

+ const IDTokenSigning

+ const JARMSigning

+ const RequestObjectSigning

+ type SigningRequest struct

+ Algorithm fapi.SignatureAlgorithm

+ Digest []byte

+ Purpose SigningPurpose

+ type VerificationKey struct

+ Algorithm fapi.SignatureAlgorithm

+ KeyID string

+ PublicKey crypto.PublicKey

+ type VerificationKeySet struct

+ Keys []VerificationKey

+ type VerificationPurpose uint8

+ const ClientAssertionVerification

+ const RequestObjectVerification