EdgeOAuthClient

@atiproto/edge-oauth-client

Extends OAuthClient from @atproto/oauth-client with WebCrypto-based cryptography and edge-compatible defaults for DID and handle resolution.

Constructor

typescript

new EdgeOAuthClient(options: EdgeOAuthClientOptions)

All options from OAuthClientOptions are accepted. The following have edge-specific defaults or are required:

Option	Type	Default	Description
clientMetadata	OAuthClientMetadata	required	OAuth 2.0 client metadata. Must include `client_id`, `redirect_uris`, and `dpop_bound_access_tokens: true`.
stateStore	StateStore	required	Stores transient OAuth state between the authorization request and callback. Use KvStateStore.
sessionStore	SessionStore	required	Persists authenticated sessions for `restore()`. Use KvSessionStore.
keyset	Keyset	optional	Required for confidential clients. Build one from a private JWK with getKeyset. Public clients (`token_endpoint_auth_method: "none"`) omit this option.
responseMode	"query" \| "fragment"	"query"	How the authorization server returns the code. Workers cannot read fragments, so `"query"` is the correct choice.
didResolver	DidResolver	EdgeDidResolver (plc.directory, 3s timeout)	Resolves DIDs to DID documents. Override to use edge-resolver-cache for durability.
handleResolver	HandleResolver	EdgeXrpcHandleResolver (public.api.bsky.app)	Resolves ATProto handles to DIDs via XRPC.
didCache	DidCache	in-memory only	Cache for resolved DID documents. Use createDidCache() for a tiered Cache API + memory cache.
handleCache	HandleCache	in-memory only	Cache for resolved handles. Use createHandleCache() for a tiered Cache API + memory cache.

With Resolver Caching

The default in-memory caches reset when the Worker isolate recycles. For better durability, provide Cache API-backed caches:

typescript

import { createDidCache, createHandleCache } from "@atiproto/edge-resolver-cache";

const client = new EdgeOAuthClient({
  // ...
  didCache: createDidCache(),
  handleCache: createHandleCache(),
});

Inherited Methods

All methods from OAuthClient are available.

Method	Description
authorize(handle, params)	Generates an authorization URL for the given ATProto handle. Redirect the user to this URL to begin the OAuth flow.
callback(params)	Exchanges the authorization code for a session. Pass the callback URL's search params directly.
restore(did)	Restores a previously authenticated session by DID. Automatically refreshes tokens if expired.