Question 1

How to set up an OAuth 2.0 server with kivra/oauth2 in Erlang?

Accepted Answer

Start by implementing the `oauth2_backend` behavior for your authentication and persistence, then configure the library in your app.config with backend settings and token expiry times. Refer to the provided examples and mock backend for guidance.

Question 2

What's the difference between kivra/oauth2 and oauth2_webmachine?

Accepted Answer

kivra/oauth2 is a core library for OAuth 2.0 server logic, while oauth2_webmachine is a related project that integrates it with the Webmachine web server. Use kivra/oauth2 for the authorization framework, and oauth2_webmachine if you need a ready-to-use server implementation.

Question 3

How can I persist tokens to a database using kivra/oauth2?

Accepted Answer

You need to implement the `store_token` and `retrieve_token` functions in your custom `oauth2_backend` module to handle database operations. The library doesn't provide built-in persistence, so this requires manual coding based on your storage system.

Question 4

Is kivra/oauth2 production-ready given the alpha version?

Accepted Answer

The alpha status (0.7.x) suggests it may have instability or breaking changes; for production, consider the stable 0.6.1 version, but note that even stable versions require thorough testing due to the custom backend implementation.

Question 5

How to handle scope validation in kivra/oauth2?

Accepted Answer

Use the `oauth2_priv_set` utility module to manage scopes as sets of binaries, allowing subset validation. For example, you can check if a client's scope is a subset of allowed scopes, as shown in the README with `is_subset/2` calls.

Question 6

Can I use kivra/oauth2 with Elixir's Phoenix framework?

Accepted Answer

Yes, since it's an Erlang library, it can be integrated into Elixir projects via Mix dependencies. However, you'll need to wrap the Erlang calls and implement the backend in Elixir, which may require additional bridging code.

Question 7

What OAuth 2.0 flows does kivra/oauth2 support?

Accepted Answer

It supports key flows like authorization code, client credentials, password credentials, and refresh token, as indicated by the configurable settings in app.config for each flow type with expiry overrides.

oauth2

What is oauth2?

Overview

Use Cases

Best For

Found a gem we're missing?

Not Ideal For

Pros & Cons

Pros

Cons

Frequently Asked Questions