# `WardrikOAuth.Provider`

An OAuth app with a service. It has the same name as the credential it grants.

    github: [
      issuer: "https://github.com/login/oauth",
      client_id: System.fetch_env!("GITHUB_CLIENT_ID"),
      client_secret: {:secret, "GITHUB_CLIENT_SECRET"},
      scopes: ~w(repo),
      flow: :device
    ]

## Options

  * `:issuer` - the authorization server, whose metadata names its endpoints.
  * `:resource` - the API or MCP server the token is for. Used to discover the issuer if none is
    given.
  * `:authorization_endpoint`, `:token_endpoint` - the endpoints, for a service without
    metadata.
  * `:client_id` - your OAuth app's client ID. Without it, Wardrik becomes the client where the
    service allows. See `WardrikOAuth.add_provider/3`.
  * `:client_secret` - the client secret, or `{:secret, name}` to read it from the vault.
  * `:client_auth` - `:post` to send the secret in the form, or `:basic` for HTTP Basic.
    `:post` unless set.
  * `:scopes` - scopes to ask for. `[]` unless set.
  * `:flow` - `:browser` or `:device`. `:browser` unless set.
  * `:authorization_params` - extra parameters for a browser sign-in, as
    `%{access_type: "offline"}`. Can't set the parameters Wardrik sends itself.

A provider needs an `:issuer`, a `:resource`, or both endpoints.

# `t`

```elixir
@type t() :: %WardrikOAuth.Provider{
  authorization_endpoint: String.t() | nil,
  authorization_params: %{optional(String.t()) => String.t()},
  client_auth: :post | :basic,
  client_id: String.t() | nil,
  client_secret: WardrikVault.value(),
  flow: :browser | :device,
  issuer: String.t() | nil,
  name: String.t(),
  resource: String.t() | nil,
  scopes: [String.t()],
  token_endpoint: String.t() | nil
}
```

An OAuth app a principal can grant access to.

# `endpoints?`

```elixir
@spec endpoints?(t()) :: boolean()
```

Returns whether the provider names both endpoints, so none need discovering.

# `new`

```elixir
@spec new(atom() | String.t(), keyword()) :: t()
```

Builds a provider from its name and options. Raises `ArgumentError` on invalid options.

---

*Consult [api-reference.md](api-reference.md) for complete listing*