auth.provider API
    Preparing search index...

    Snapshot of a successful federation callback: identity + OIDC-standard claims + OAuth 2 tokens.

    The [key: string]: unknown index signature is an extension slot for provider-specific claims (Google hd, Microsoft tid, etc). Promote a claim to first-class only when it becomes widely useful across providers (see Migration Guide in the spec).

    Fields are ordered to match the RFC 6749 §5.1 + OIDC Core §5.1 claim sources.

    interface FederationProfile {
        accessToken?: string;
        email?: string;
        emailVerified?: boolean;
        expiresAt: Date | null;
        idToken?: string;
        issuer: string;
        name?: string;
        picture?: string;
        refreshToken?: string;
        sub: string;
        readonly [key: string]: unknown;
    }

    Indexable

    • readonly [key: string]: unknown

      Provider-specific extension claims (e.g. Google hd, Microsoft tid).

    Index

    Properties

    accessToken?: string

    OAuth 2 access token for subsequent IdP API calls.

    email?: string
    emailVerified?: boolean
    expiresAt: Date | null

    Absolute expiry time of accessToken, derived from expires_in by the adapter.

    null means the provider did not issue a finite expiry (e.g. GitHub OAuth Apps classic tokens). Consumers MUST treat null as "do not attempt refresh; reuse until the provider explicitly invalidates". Required (no undefined) so adapters are forced to make an explicit decision per provider rather than the route layer inventing a fallback expiry.

    idToken?: string

    OIDC id_token JWT, if issued.

    issuer: string

    IdP issuer URL (OIDC discovery issuer) or provider name for non-OIDC providers.

    name?: string
    picture?: string
    refreshToken?: string

    Refresh token; absent if the IdP did not issue one.

    sub: string

    OIDC sub claim — stable identifier for the federated user at this IdP.