Skip to main content

Interface: PublicClientSpec

Defined in: packages/identity/src/port.ts:390

A public client: authorization code with PKCE (S256, mandatory), exact redirect match, no direct grant. A redirect URI ending /* on a loopback host (127.0.0.1, [::1]) matches any port (RFC 8252 section 7.3).

Extends​

  • ClientSpecBase

Properties​

clientId​

readonly clientId: string

Defined in: packages/identity/src/port.ts:357

The OAuth client id. Lowercase, hyphenated.

Inherited from​

ClientSpecBase.clientId

description?​

readonly optional description?: string

Defined in: packages/identity/src/port.ts:359

What it is for.

Inherited from​

ClientSpecBase.description

kind​

readonly kind: "public"

Defined in: packages/identity/src/port.ts:392

Selects this shape of ClientSpec.

offlineAccess?​

readonly optional offlineAccess?: boolean

Defined in: packages/identity/src/port.ts:398

Whether the client may obtain refresh tokens that outlive the session.

redirectUris​

readonly redirectUris: readonly string[]

Defined in: packages/identity/src/port.ts:394

Allowed redirect URIs.

scopes​

readonly scopes: readonly string[]

Defined in: packages/identity/src/port.ts:365

Scopes the client receives by default. Each must exist (ensureScope), and the audience mappers of each must already have been ensured: on WSO2 a client picks up an audience only from mappers that exist when it is ensured.

Inherited from​

ClientSpecBase.scopes

secondFactor?​

readonly optional secondFactor?: "totp"

Defined in: packages/identity/src/port.ts:409

A second factor every sign-in through this client must pass after the password, with enrolment at the first sign-in for a person who has none (PO9, PO-QA6).

On WSO2 this is the application's authentication sequence (password, then TOTP), converged on every run. On Keycloak it is already met per realm: the required action configure-totp enrols the person, and the browser flow's OTP step then asks for the code on every sign-in, for every client; the adapter has nothing to set per client. Absent leaves the client's sign-in steps as they are.

tokenLifetimes?​

readonly optional tokenLifetimes?: TokenLifetimes

Defined in: packages/identity/src/port.ts:367

Where the provider keeps lifetimes per client, these are applied; elsewhere they are reported unsupported.

Inherited from​

ClientSpecBase.tokenLifetimes

webOrigins?​

readonly optional webOrigins?: readonly string[]

Defined in: packages/identity/src/port.ts:396

Allowed web origins, for browser clients.