Contents

thoven87/oauth-kit

A Swift OAuth2 and OpenID Connect client library with modern async/await support, built on top of JWT-Kit, compatible with Linux and macOS.

Features

  • OAuth 2.0 Authorization Code Flow with PKCE
  • OAuth 2.0 Client Credentials Flow
  • OAuth 2.0 Device Authorization Flow (RFC 8628)
  • OAuth 2.0 Token Exchange (RFC 8693), Introspection (RFC 7662), and Revocation (RFC 7009)
  • OpenID Connect with JWT validation and auto-discovery
  • Automatic JWKS refresh with per-endpoint key isolation and Cache-Control-driven scheduling
  • Multi-Factor Authentication support (Okta push, SMS, TOTP)
  • 15+ built-in providers: Google, Microsoft, Auth0, Discord, GitHub, Apple, Okta, AWS Cognito, and more
  • Google Service Account authentication and domain-wide delegation
  • Framework-agnostic — works with Vapor, Hummingbird, raw SwiftNIO, or any Swift server
  • Swift 6 strict concurrency

Requirements

  • Swift 6.0+
  • macOS 13+ / Linux

Installation

Add OAuthKit to your Package.swift:

dependencies: [
    .package(url: "https://github.com/thoven87/oauth-kit.git", from: "1.0.0")
]

Then add it to your target:

.target(
    name: "YourTarget",
    dependencies: [
        .product(name: "OAuthKit", package: "oauth-kit")
    ]
)

Quick Start

import OAuthKit
import ServiceLifecycle

// OAuthClientFactory manages the HTTP client, JWKS refresh service, and all providers.
let oauthKit = OAuthClientFactory()

// Creating a provider automatically registers its JWKS endpoint for background refresh.
let googleProvider = try await oauthKit.googleProvider(
    clientID: "your-google-client-id",
    clientSecret: "your-google-client-secret",
    redirectURI: "https://your-app.com/auth/google/callback"
)

// Generate a PKCE authorization URL.
let (authURL, codeVerifier) = try googleProvider.generateAuthURL(
    state: UUID().uuidString,
    scopes: ["openid", "profile", "email"]
)

// After the user is redirected back, exchange the code for tokens.
let (tokenResponse, claims) = try await googleProvider.exchangeCode(
    code: authorizationCode,
    codeVerifier: codeVerifier
)

// Run the JWKS refresh service (typically inside a ServiceGroup).
try await oauthKit.run()

Documentation

Full documentation is available on the Swift Package Index, including:

Contributing

Contributions are welcome! Please feel free to submit a Pull Request.

License

This library is released under the Apache 2.0 license.

Package Metadata

Repository: thoven87/oauth-kit

Default branch: main

README: README.md