Go OAuth2

https://pkg.go.dev/golang.org/x/oauth2
Admin
Provides support for making OAuth2 authorized and authenticated HTTP requests, as specified in RFC...
Tokens:48,538
Snippets:559
Trust Score:10
Update:1 month ago
Show doc for...
Tokens:
Raw
### ImpersonateTokenSource.Token method signature

Source: https://pkg.go.dev/golang.org/x/oauth2/google/internal/impersonate

Method signature for Token, which performs the exchange to get a temporary service account token for GCP access.

```go
func (its ImpersonateTokenSource) Token() (*oauth2.Token, error)
```

--------------------------------

### LazyAuthStyleCache.Get method

Source: https://pkg.go.dev/golang.org/x/oauth2/internal

Get returns the underlying AuthStyleCache pointer.

```go
func (lc *LazyAuthStyleCache) Get() *AuthStyleCache
```

--------------------------------

### Config.Client method

Source: https://pkg.go.dev/golang.org/x/oauth2/clientcredentials

Returns an HTTP client that uses the provided token, with automatic refreshing as needed.

```go
func (c *Config) Client(ctx context.Context) *http.Client
```

--------------------------------

### Config.Token method

Source: https://pkg.go.dev/golang.org/x/oauth2/clientcredentials

Retrieves a token using the client credentials flow.

```go
func (c *Config) Token(ctx context.Context) (*oauth2.Token, error)
```

--------------------------------

### Config

Source: https://pkg.go.dev/golang.org/x/oauth2/google/externalaccount

Configuration struct for external account token fetching, including required and optional fields.

```APIDOC
## Config

### Description
Config stores the configuration for fetching tokens with external credentials. It contains fields for audience, token type, endpoints, and optional suppliers.

### Fields

- **Audience** (string) - Required - The Secure Token Service (STS) audience which contains the resource name for the workload identity pool or the workforce pool and the provider identifier in that pool.
- **SubjectTokenType** (string) - Required - The STS token type based on the Oauth2.0 token exchange spec. Expected values include: "urn:ietf:params:oauth:token-type:jwt", "urn:ietf:params:oauth:token-type:id-token", "urn:ietf:params:oauth:token-type:saml2", "urn:ietf:params:aws:token-type:aws4_request".
- **TokenURL** (string) - Optional - The STS token exchange endpoint. If not provided, defaults to https://sts.UNIVERSE_DOMAIN/v1/token, with UNIVERSE_DOMAIN set to the default service domain googleapis.com unless UniverseDomain is set.
- **TokenInfoURL** (string) - Optional - The token_info endpoint used to retrieve the account related information (user attributes like account identifier, eg. email, username, uid, etc). Needed for gCloud session account identification.
- **ServiceAccountImpersonationURL** (string) - Optional - The URL for the service account impersonation request. Only required for workload identity pools when APIs to be accessed have not integrated with UberMint.
- **ServiceAccountImpersonationLifetimeSeconds** (int) - Optional - The number of seconds the service account impersonation token will be valid for. Defaults to 3600 if not provided.
- **ClientSecret** (string) - Optional - Currently only required if token_info endpoint also needs to be called with the generated GCP access token. When provided, STS will be called with additional basic authentication using ClientId as username and ClientSecret as password.
- **ClientID** (string) - Optional - Only required in conjunction with ClientSecret, as described above.
- **CredentialSource** (*CredentialSource) - Optional - Contains the necessary information to retrieve the token itself, as well as some environmental information. One of SubjectTokenSupplier, AWSSecurityCredentialSupplier or CredentialSource must be provided.
- **QuotaProjectID** (string) - Optional - Injected by gCloud. If non-empty, the Auth libraries will set the x-goog-user-project header which overrides the project associated with the credentials.
- **Scopes** ([]string) - Optional - Contains the desired scopes for the returned access token.
- **WorkforcePoolUserProject** (string) - Optional - The workforce pool user project number when the credential corresponds to a workforce pool and not a workload identity pool. The underlying principal must still have serviceusage.services.use IAM permission to use the project for billing/quota.
- **SubjectTokenSupplier** (SubjectTokenSupplier) - Optional - An optional token supplier for OIDC/SAML credentials. One of SubjectTokenSupplier, AWSSecurityCredentialSupplier or CredentialSource must be provided.
- **AwsSecurityCredentialsSupplier** (AwsSecurityCredentialsSupplier) - Optional - An AWS Security Credential supplier for AWS credentials. One of SubjectTokenSupplier, AWSSecurityCredentialSupplier or CredentialSource must be provided.
- **UniverseDomain** (string) - Optional - The default service domain for a given Cloud universe. Used in the default STS token URL. Default value is "googleapis.com". Not used if TokenURL is set.
```

--------------------------------

### ReuseTokenSource function

Source: https://pkg.go.dev/golang.org/x/oauth2

ReuseTokenSource returns a TokenSource which repeatedly returns the same token as long as it's valid, starting with t. When its cached token is invalid, a new token is obtained from src. Typically used to reuse tokens from a cache (such as a file on disk) between runs of a program. The initial token t may be nil, in which case the TokenSource is wrapped in a caching version if it isn't one already. It's always safe to wrap ReuseTokenSource around any other TokenSource without adverse effects.

```go
func ReuseTokenSource(t *Token, src TokenSource) TokenSource
```

--------------------------------

### NewSDKConfig

Source: https://pkg.go.dev/golang.org/x/oauth2/google

Creates a new SDKConfig for the given account.

```APIDOC
## NewSDKConfig

### Description
Creates a new SDKConfig for the given account.

### Function Signature
`func NewSDKConfig(account string) (*SDKConfig, error)`

### Parameters
- **account** (string) - Required - The account name.

### Returns
- **SDKConfig** - The SDK configuration.
- **error** - An error if creation fails.
```

--------------------------------

### ConfigFromJSON function signature

Source: https://pkg.go.dev/golang.org/x/oauth2/google

Constructs an oauth2.Config from a Google Developers Console client_credentials.json file. The jsonKey parameter should be the contents of the downloaded JSON file. The scope arguments are optional.

```go
func ConfigFromJSON(jsonKey []byte, scope ...string) (*oauth2.Config, error)
```

--------------------------------

### Config.TokenSource method

Source: https://pkg.go.dev/golang.org/x/oauth2/clientcredentials

Returns a TokenSource that manages token expiration and automatic refreshing. Most users should prefer Config.Client.

```go
func (c *Config) TokenSource(ctx context.Context) oauth2.TokenSource
```

--------------------------------

### SDKConfig.Client

Source: https://pkg.go.dev/golang.org/x/oauth2/google

Returns an HTTP client that uses the token source from the SDK config.

```APIDOC
## SDKConfig.Client

### Description
Returns an HTTP client that uses the token source from the SDK config.

### Method Signature
`func (c *SDKConfig) Client(ctx context.Context) *http.Client`

### Parameters
- **c** (*SDKConfig) - Required - The SDK config.
- **ctx** (context.Context) - Required - The context.

### Returns
- **http.Client** - An HTTP client with authorization.
```

--------------------------------

### Bitbucket endpoint

Source: https://pkg.go.dev/golang.org/x/oauth2/endpoints

Bitbucket is the endpoint for Bitbucket.

```go
var Bitbucket = oauth2.Endpoint{
	AuthURL:  "https://bitbucket.org/site/oauth2/authorize",
	TokenURL: "https://bitbucket.org/site/oauth2/access_token",
}

```

--------------------------------

### func (c *Config) Client(ctx context.Context) *http.Client

Source: https://pkg.go.dev/golang.org/x/oauth2/jwt

Client returns an HTTP client wrapping the context's HTTP transport and adding Authorization headers with tokens obtained from c. The returned client and its Transport should not be modified.

```APIDOC
## func (c *Config) Client(ctx context.Context) *http.Client

### Description
Client returns an HTTP client wrapping the context's HTTP transport and adding Authorization headers with tokens obtained from c. The returned client and its Transport should not be modified.

### Method
Client

### Parameters
- **ctx** (context.Context) - The context to use for the client.

### Returns
- **http.Client** - An HTTP client with Authorization headers set.

### Example
go
client := config.Client(ctx)

```

--------------------------------

### NewSDKConfig

Source: https://pkg.go.dev/golang.org/x/oauth2/google

Creates an SDKConfig for the given Google Cloud SDK account. If account is empty, the active account is used. Requires gcloud auth to have been run.

```APIDOC
## NewSDKConfig

### Description
NewSDKConfig creates an SDKConfig for the given Google Cloud SDK account. If account is empty, the account currently active in Google Cloud SDK properties is used. Google Cloud SDK credentials must be created by running `gcloud auth` before using this function.

### Method
FUNCTION

### Endpoint
NewSDKConfig(account string) (*SDKConfig, error)

### Parameters
#### Parameters
- **account** (string) - Required - The Google Cloud SDK account to use. If empty, the active account is used.

### Response
#### Success Response
- **SDKConfig** (*SDKConfig) - The SDKConfig for the given account.
- **error** (error) - An error if the configuration could not be created.

#### Response Example
```go
config, err := NewSDKConfig("my-account")
```
```

--------------------------------

### HTTPClient variable

Source: https://pkg.go.dev/golang.org/x/oauth2/internal

HTTPClient is the context key to use with context.WithValue to associate an *http.Client value with a context.

```go
var HTTPClient ContextKey
```

--------------------------------

### MediaMath OAuth2 Endpoints (production and sandbox)

Source: https://pkg.go.dev/golang.org/x/oauth2/mediamath

Defines the OAuth 2.0 endpoints for MediaMath. The first is for production, the second for sandbox. Use the appropriate endpoint when configuring OAuth2 clients.

```go
var Endpoint = oauth2.Endpoint{
	AuthURL:  "https://api.mediamath.com/oauth2/v1.0/authorize",
	TokenURL: "https://api.mediamath.com/oauth2/v1.0/token",
}
```

```go
var SandboxEndpoint = oauth2.Endpoint{
	AuthURL:  "https://t1sandbox.mediamath.com/oauth2/v1.0/authorize",
	TokenURL: "https://t1sandbox.mediamath.com/oauth2/v1.0/token",
}
```

--------------------------------

### ConfigFromJSON

Source: https://pkg.go.dev/golang.org/x/oauth2/google

Constructs an oauth2.Config from a Google Developers Console client_credentials.json file.

```APIDOC
## ConfigFromJSON

### Description
Constructs an oauth2.Config from a Google Developers Console client_credentials.json file.

### Function Signature
```go
func ConfigFromJSON(jsonKey []byte, scope ...string) (*oauth2.Config, error)
```

### Parameters
- **jsonKey** ([]byte) - Required - Contents of the client_credentials.json file.
- **scope** (...string) - Optional - Scopes to request.

### Returns
- **config** (*oauth2.Config) - The constructed config.
- **error** (error) - Any error encountered.

```

--------------------------------

### NewSDKConfig function signature

Source: https://pkg.go.dev/golang.org/x/oauth2/google

Creates an SDKConfig for the given Google Cloud SDK account. If account is empty, the currently active account in Google Cloud SDK properties is used. Requires running `gcloud auth` before use.

```go
func NewSDKConfig(account string) (*SDKConfig, error)
```

--------------------------------

### Load service account credentials with CredentialsFromJSONWithTypeAndParams

Source: https://pkg.go.dev/golang.org/x/oauth2/google

Recommended replacement for deprecated CredentialsFromJSONWithParams. Loads only service account credentials with additional parameters. Must still validate configurations from external sources.

```go
creds, err := google.CredentialsFromJSONWithTypeAndParams(ctx, jsonData, google.ServiceAccount, params)

```

--------------------------------

### Define Endpoint for PayPal Live Environment

Source: https://pkg.go.dev/golang.org/x/oauth2/paypal

Use this variable to configure the OAuth2 endpoint for production PayPal environments.

```go
var Endpoint = oauth2.Endpoint{
	AuthURL:  "https://www.paypal.com/webapps/auth/protocol/openidconnect/v1/authorize",
	TokenURL: "https://api.paypal.com/v1/identity/openidconnect/tokenservice",
}
```

--------------------------------

### func (c *Config) Client(ctx context.Context) *http.Client

Source: https://pkg.go.dev/golang.org/x/oauth2/clientcredentials

Client returns an HTTP client using the provided token. The token will auto-refresh as necessary. The provided context optionally controls which HTTP client is returned. The returned http.Client and its Transport should not be modified.

```APIDOC
## func (c *Config) Client(ctx context.Context) *http.Client

### Description
Client returns an HTTP client using the provided token. The token will auto-refresh as necessary. The provided context optionally controls which HTTP client is returned. See the oauth2.HTTPClient variable. The returned http.Client and its Transport should not be modified.

### Parameters
- **ctx** (context.Context) - The context optionally controls which HTTP client is returned.

### Returns
- **http.Client** - An HTTP client that uses the token and auto-refreshes it as necessary.

```

--------------------------------

### ConfigFromJSON

Source: https://pkg.go.dev/golang.org/x/oauth2/google

Creates an oauth2.Config from a JSON key file, supporting service account and web application credentials.

```APIDOC
## ConfigFromJSON

### Description
Creates an oauth2.Config from a JSON key file. The JSON key can be a service account key or a web application client secret.

### Function Signature
`func ConfigFromJSON(jsonKey []byte, scope ...string) (*oauth2.Config, error)`

### Parameters
- **jsonKey** ([]byte) - Required - JSON key data.
- **scope** (string) - Optional - OAuth 2.0 scopes.

### Returns
- **oauth2.Config** - The OAuth2 configuration.
- **error** - An error if parsing fails.
```

--------------------------------

### func NewClient(ctx context.Context, src TokenSource) *http.Client

Source: https://pkg.go.dev/golang.org/x/oauth2

Creates an *http.Client from a context.Context and TokenSource. The returned client is not valid beyond the lifetime of the context. If src is nil, a non-OAuth2 client is returned.

```APIDOC
## func NewClient(ctx context.Context, src TokenSource) *http.Client

### Description
Creates an *http.Client from a context.Context and TokenSource. The returned client is not valid beyond the lifetime of the context. Note that if a custom *http.Client is provided via the context.Context it is used only for token acquisition and is not used to configure the *http.Client returned from NewClient. As a special case, if src is nil, a non-OAuth2 client is returned using the provided context.

### Function Signature
`func NewClient(ctx context.Context, src TokenSource) *http.Client`

### Parameters
- **ctx** (context.Context) - Required - The context to associate with the client.
- **src** (TokenSource) - Required - The token source to use for authentication. If nil, a non-OAuth2 client is returned.

### Returns
- **\*http.Client** - The created HTTP client.
```

--------------------------------

### var LiveConnectEndpoint = oauth2.Endpoint{...}

Source: https://pkg.go.dev/golang.org/x/oauth2/microsoft

LiveConnectEndpoint is Windows's Live ID OAuth 2.0 endpoint.

```APIDOC
## LiveConnectEndpoint

### Description
LiveConnectEndpoint is Windows's Live ID OAuth 2.0 endpoint.

### Type
Variable

### Definition
go
var LiveConnectEndpoint = oauth2.Endpoint{
	AuthURL:  "https://login.live.com/oauth20_authorize.srf",
	TokenURL: "https://login.live.com/oauth20_token.srf",
}


### Fields
- **AuthURL** (string) - The authorization endpoint URL.
- **TokenURL** (string) - The token endpoint URL.
```

--------------------------------

### SDKConfig.Client method signature

Source: https://pkg.go.dev/golang.org/x/oauth2/google

Returns an HTTP client using Google Cloud SDK credentials to authorize requests. The token auto-refreshes as necessary. The returned client and its Transport should not be modified.

```go
func (c *SDKConfig) Client(ctx context.Context) *http.Client
```

--------------------------------

### google package API

Source: https://pkg.go.dev/golang.org/x/oauth2/google

Documentation for the google package variables, types, and constants.

```APIDOC
## [VARIABLE] AuthHandler

### Description
AuthHandler is the AuthorizationHandler used for 3-legged OAuth flow. Required for 3LO flow.

### Type
`authhandler.AuthorizationHandler`

### Usage
Set this variable to the authorization handler for 3-legged OAuth flow.

## [VARIABLE] State

### Description
State is a unique string used with AuthHandler. Required for 3LO flow.

### Type
`string`

### Usage
Set this variable to a unique string for the OAuth state.

## [VARIABLE] PKCE

### Description
PKCE is used to support PKCE flow. Optional for 3LO flow.

### Type
`*authhandler.PKCEParams`

### Usage
Set this variable to enable PKCE flow.

## [VARIABLE] TokenURL

### Description
The OAuth2 TokenURL default override. This value overrides the default TokenURL, unless explicitly specified by the credentials config file. Optional.

### Type
`string`

### Usage
Set this variable to override the default token URL.

## [VARIABLE] EarlyTokenRefresh

### Description
EarlyTokenRefresh is the amount of time before a token expires that a new token will be preemptively fetched. If unset the default value is 10 seconds. Note: This option is currently only respected when using credentials fetched from the GCE metadata server.

### Type
`time.Duration`

### Usage
Set this variable to control how early tokens are refreshed.

## [VARIABLE] UniverseDomain

### Description
UniverseDomain is the default service domain for a given Cloud universe. Only supported in authentication flows that support universe domains. This value takes precedence over a universe domain explicitly specified in a credentials config file or by the GCE metadata server. Optional.

### Type
`string`

### Usage
Set this variable to specify the universe domain.

## [TYPE] CredentialsType

### Description
CredentialsType specifies the type of JSON credentials being provided to a loading function.

### Type
`string`

### Constants
- `ServiceAccount` (string) - Represents a service account file type.
- `AuthorizedUser` (string) - Represents a user credentials file type.
- `ExternalAccount` (string) - Represents an external account file type. IMPORTANT: This credential type does not validate the credential configuration. A security risk occurs when a credential configuration configured with malicious urls is used. You should validate credential configurations provided by untrusted sources.
- `ExternalAccountAuthorizedUser` (string) - Represents an external account authorized user file type.
- `ImpersonatedServiceAccount` (string) - Represents an impersonated service account file type. IMPORTANT: This credential type does not validate the credential configuration. A security risk occurs when a credential configuration configured with malicious urls is used. You should validate credential configurations provided by untrusted sources.
- `GDCHServiceAccount` (string) - Represents a GDCH service account credentials.

## [TYPE] DefaultCredentials (deprecated)

### Description
DefaultCredentials is the old name of Credentials. Deprecated: use Credentials instead.

### Type
`Credentials`

## [TYPE] SDKConfig

### Description
An SDKConfig provides access to tokens from an account already authorized via the Google Cloud SDK.

### Type
`struct`

### Fields
- (contains filtered or unexported fields)

### Example
```
Output:
```
```

--------------------------------

### SDKConfig.Scopes method signature

Source: https://pkg.go.dev/golang.org/x/oauth2/google

Returns the OAuth 2.0 scopes the current account is authorized for.

```go
func (c *SDKConfig) Scopes() []string
```

--------------------------------

### Load service account credentials with CredentialsFromJSONWithType

Source: https://pkg.go.dev/golang.org/x/oauth2/google

Recommended replacement for deprecated CredentialsFromJSON. Loads only service account credentials, reducing risk of loading unexpected credential types. Must still validate configurations from external sources.

```go
creds, err := google.CredentialsFromJSONWithType(ctx, jsonData, google.ServiceAccount, scopes...)

```

--------------------------------

### SDKConfig.TokenSource

Source: https://pkg.go.dev/golang.org/x/oauth2/google

Returns the token source for the SDK config.

```APIDOC
## SDKConfig.TokenSource

### Description
Returns the token source for the SDK config.

### Method Signature
`func (c *SDKConfig) TokenSource(ctx context.Context) oauth2.TokenSource`

### Parameters
- **c** (*SDKConfig) - Required - The SDK config.
- **ctx** (context.Context) - Required - The context.

### Returns
- **oauth2.TokenSource** - The token source.
```

--------------------------------

### DefaultClient function signature

Source: https://pkg.go.dev/golang.org/x/oauth2/google

Returns an HTTP client that uses the DefaultTokenSource to obtain authentication credentials.

```go
func DefaultClient(ctx context.Context, scope ...string) (*http.Client, error)
```

--------------------------------

### AuthStyle constants

Source: https://pkg.go.dev/golang.org/x/oauth2/internal

Constants for AuthStyle values: unknown, in-params, and in-header.

```go
const (
	AuthStyleUnknown  AuthStyle = 0
	AuthStyleInParams AuthStyle = 1
	AuthStyleInHeader AuthStyle = 2
)
```

--------------------------------

### Define SandboxEndpoint for PayPal Testing

Source: https://pkg.go.dev/golang.org/x/oauth2/paypal

Use this variable to configure the OAuth2 endpoint for sandbox testing environments.

```go
var SandboxEndpoint = oauth2.Endpoint{
	AuthURL:  "https://www.sandbox.paypal.com/webapps/auth/protocol/openidconnect/v1/authorize",
	TokenURL: "https://api.sandbox.paypal.com/v1/identity/openidconnect/tokenservice",
}
```

--------------------------------

### Battlenet endpoint

Source: https://pkg.go.dev/golang.org/x/oauth2/endpoints

Battlenet is the endpoint for Battlenet.

```go
var Battlenet = oauth2.Endpoint{
	AuthURL:  "https://battle.net/oauth/authorize",
	TokenURL: "https://battle.net/oauth/token",
}

```

--------------------------------

### TokenExchangeRequest struct

Source: https://pkg.go.dev/golang.org/x/oauth2/google/internal/stsexchange

Contains the fields necessary to make an OAuth2 token exchange.

```go
type TokenExchangeRequest struct {
	ActingParty struct {
		ActorToken     string
		ActorTokenType string
	}
	GrantType          string
	Resource           string
	Audience           string
	Scope              []string
	RequestedTokenType string
	SubjectToken       string
	SubjectTokenType   string
}
```

--------------------------------

### Apple endpoint

Source: https://pkg.go.dev/golang.org/x/oauth2/endpoints

Apple is the endpoint for "Sign in with Apple". Documentation: https://developer.apple.com/documentation/signinwithapplerestapi

```go
var Apple = oauth2.Endpoint{
	AuthURL:  "https://appleid.apple.com/auth/authorize",
	TokenURL: "https://appleid.apple.com/auth/token",
}

```

--------------------------------

### PKCEParams

Source: https://pkg.go.dev/golang.org/x/oauth2/authhandler

PKCEParams holds parameters to support PKCE (Proof Key for Code Exchange). It contains the code challenge, challenge method, and verifier.

```APIDOC
## PKCEParams

### Description
PKCEParams holds parameters to support PKCE (Proof Key for Code Exchange).

### Type Definition
```go
type PKCEParams struct {
	Challenge       string // The unpadded, base64-url-encoded string of the encrypted code verifier.
	ChallengeMethod string // The encryption method (ex. S256).
	Verifier        string // The original, non-encrypted secret.
}
```

### Fields
- **Challenge** (string) - The unpadded, base64-url-encoded string of the encrypted code verifier.
- **ChallengeMethod** (string) - The encryption method (ex. S256).
- **Verifier** (string) - The original, non-encrypted secret.
```

--------------------------------

### JWTConfigFromJSON function signature

Source: https://pkg.go.dev/golang.org/x/oauth2/google

Constructs a jwt.Config from a service account JSON key file. Download the key from the Google Developers Console under Credentials.

```go
func JWTConfigFromJSON(jsonKey []byte, scope ...string) (*jwt.Config, error)
```

--------------------------------

### Config struct definition

Source: https://pkg.go.dev/golang.org/x/oauth2/clientcredentials

The Config struct holds the application's client ID, secret, token URL, and optional configuration for scopes, endpoint parameters, and authentication style.

```go
type Config struct {
	// ClientID is the application's ID.
	ClientID string

	// ClientSecret is the application's secret.
	ClientSecret string

	// TokenURL is the resource server's token endpoint
	// URL. This is a constant specific to each server.
	TokenURL string

	// Scopes specifies optional requested permissions.
	Scopes []string

	// EndpointParams specifies additional parameters for requests to the token endpoint.
	EndpointParams url.Values

	// AuthStyle optionally specifies how the endpoint wants the
	// client ID & client secret sent. The zero value means to
	// auto-detect.
	AuthStyle oauth2.AuthStyle
	// contains filtered or unexported fields
}
```

--------------------------------

### Dropbox endpoint

Source: https://pkg.go.dev/golang.org/x/oauth2/endpoints

Dropbox is the endpoint for Dropbox. Documentation: https://developers.dropbox.com/oauth-guide

```go
var Dropbox = oauth2.Endpoint{
	AuthURL:  "https://www.dropbox.com/oauth2/authorize",
	TokenURL: "https://api.dropboxapi.com/oauth2/token",
}

```

--------------------------------

### Config struct definition

Source: https://pkg.go.dev/golang.org/x/oauth2/google/internal/externalaccountauthorizeduser

Defines the Config struct with fields for external account authorized user credentials, including Audience, RefreshToken, TokenURL, TokenInfoURL, ClientID, ClientSecret, Token, Expiry, RevokeURL, QuotaProjectID, and Scopes.

```go
type Config struct {
	// Audience is the Secure Token Service (STS) audience which contains the resource name for the workforce pool and
	// the provider identifier in that pool.
	Audience string
	// RefreshToken is the optional OAuth 2.0 refresh token. If specified, credentials can be refreshed.
	RefreshToken string
	// TokenURL is the optional STS token exchange endpoint for refresh. Must be specified for refresh, can be left as
	// None if the token can not be refreshed.
	TokenURL string
	// TokenInfoURL is the optional STS endpoint URL for token introspection.
	TokenInfoURL string
	// ClientID is only required in conjunction with ClientSecret, as described above.
	ClientID string
	// ClientSecret is currently only required if token_info endpoint also needs to be called with the generated GCP
	// access token. When provided, STS will be called with additional basic authentication using client_id as username
	// and client_secret as password.
	ClientSecret string
	// Token is the OAuth2.0 access token. Can be nil if refresh information is provided.
	Token string
	// Expiry is the optional expiration datetime of the OAuth 2.0 access token.
	Expiry time.Time
	// RevokeURL is the optional STS endpoint URL for revoking tokens.
	RevokeURL string
	// QuotaProjectID is the optional project ID used for quota and billing. This project may be different from the
	// project used to create the credentials.
	QuotaProjectID string
	Scopes         []string
}
```

--------------------------------

### ClientAuthentication struct

Source: https://pkg.go.dev/golang.org/x/oauth2/google/internal/stsexchange

Defines the OAuth client credentials and the authentication style (basic or request-body) used for Secure Token Service requests.

```go
type ClientAuthentication struct {
	// AuthStyle can be either basic or request-body
	AuthStyle    oauth2.AuthStyle
	ClientID     string
	ClientSecret string
}
```

--------------------------------

### Client

Source: https://pkg.go.dev/golang.org/x/oauth2/google

Returns an HTTP client that uses Google Cloud SDK credentials to authorize requests. The token auto-refreshes as necessary.

```APIDOC
## Client

### Description
Client returns an HTTP client using Google Cloud SDK credentials to authorize requests. The token will auto-refresh as necessary. The underlying http.RoundTripper will be obtained using the provided context. The returned client and its Transport should not be modified.

### Method
FUNCTION

### Endpoint
func (c *SDKConfig) Client(ctx context.Context) *http.Client

### Parameters
#### Parameters
- **ctx** (context.Context) - Required - The context used to obtain the underlying http.RoundTripper.

### Response
#### Success Response
- **http.Client** (*http.Client) - An HTTP client that authorizes requests using Google Cloud SDK credentials.

#### Response Example
```go
client := config.Client(ctx)
```
```

--------------------------------

### Config.TokenSource method signature

Source: https://pkg.go.dev/golang.org/x/oauth2

Returns a TokenSource that returns t until it expires, automatically refreshing it as necessary. Most users will use Config.Client instead.

```go
func (c *Config) TokenSource(ctx context.Context, t *Token) TokenSource
```

--------------------------------

### Token and TokenSource

Source: https://pkg.go.dev/golang.org/x/oauth2

This section documents the Token type, TokenSource interface, and related functions and methods in the golang.org/x/oauth2 package. It includes the Token struct fields, methods for accessing token data, and the TokenSource interface for obtaining tokens.

```APIDOC
## Token

### Description
Token represents the credentials used to authorize the requests to access protected resources on the OAuth 2.0 provider's backend. Most users of this package should not access fields of Token directly. They're exported mostly for use by related packages implementing derivative OAuth2 flows.

### Fields
- **AccessToken** (string) - The token that authorizes and authenticates the requests.
- **TokenType** (string) - The type of token. The Type method returns either this or "Bearer", the default.
- **RefreshToken** (string) - A token that's used by the application (as opposed to the user) to refresh the access token if it expires.
- **Expiry** (time.Time) - The optional expiration time of the access token. If zero, TokenSource implementations will reuse the same token forever and RefreshToken or equivalent mechanisms for that TokenSource will not be used.
- **ExpiresIn** (int64) - The OAuth2 wire format "expires_in" field, which specifies how many seconds later the token expires, relative to an unknown time base approximately around "now". It is the application's responsibility to populate Expiry from ExpiresIn when required.

### Methods
#### Extra

##### Description
Extra returns an extra field. Extra fields are key-value pairs returned by the server as part of the token retrieval response.

##### Signature
`func (t *Token) Extra(key string) any`

##### Parameters
- **key** (string) - The key of the extra field to retrieve.

##### Returns
- **any** - The value of the extra field.

#### SetAuthHeader

##### Description
SetAuthHeader sets the Authorization header to r using the access token in t. This method is unnecessary when using Transport or an HTTP Client returned by this package.

##### Signature
`func (t *Token) SetAuthHeader(r *http.Request)`

##### Parameters
- **r** (*http.Request) - The HTTP request to set the Authorization header on.

#### Type

##### Description
Type returns t.TokenType if non-empty, else "Bearer".

##### Signature
`func (t *Token) Type() string`

##### Returns
- **string** - The token type.

#### Valid

##### Description
Valid reports whether t is non-nil, has an AccessToken, and is not expired.

##### Signature
`func (t *Token) Valid() bool`

##### Returns
- **bool** - Whether the token is valid.

#### WithExtra

##### Description
WithExtra returns a new Token that's a clone of t, but using the provided raw extra map. This is only intended for use by packages implementing derivative OAuth2 flows.

##### Signature
`func (t *Token) WithExtra(extra any) *Token`

##### Parameters
- **extra** (any) - The raw extra map to use.

##### Returns
- **\*Token** - A new Token with the provided extra map.

## TokenSource

### Description
A TokenSource is anything that can return a token.

### Interface
```go
type TokenSource interface {
	// Token returns a token or an error.
	// Token must be safe for concurrent use by multiple goroutines.
	// The returned Token must not be modified.
	Token() (*Token, error)
}
```

### Methods
#### Token

##### Description
Token returns a token or an error. Token must be safe for concurrent use by multiple goroutines. The returned Token must not be modified.

##### Signature
`Token() (*Token, error)`

##### Returns
- **\*Token** - The token.
- **error** - An error, if any.

## ReuseTokenSource

### Description
ReuseTokenSource returns a TokenSource which repeatedly returns the same token as long as it's valid, starting with t. When its cached token is invalid, a new token is obtained from src. ReuseTokenSource is typically used to reuse tokens from a cache (such as a file on disk) between runs of a program, rather than obtaining new tokens unnecessarily. The initial token t may be nil, in which case the TokenSource is wrapped in a caching version if it isn't one already. This also means it's always safe to wrap ReuseTokenSource around any other TokenSource without adverse effects.

### Signature
`func ReuseTokenSource(t *Token, src TokenSource) TokenSource`

### Parameters
- **t** (\*Token) - The initial token to reuse.
- **src** (TokenSource) - The source to obtain new tokens from when the cached token is invalid.

### Returns
- **TokenSource** - A TokenSource that reuses the token until it becomes invalid.

## ReuseTokenSourceWithExpiry

### Description
ReuseTokenSourceWithExpiry returns a TokenSource that acts in the same manner as the TokenSource returned by ReuseTokenSource, except the expiry buffer is configurable. The expiration time of a token is calculated as t.Expiry.Add(-earlyExpiry).

### Signature
`func ReuseTokenSourceWithExpiry(t *Token, src TokenSource, earlyExpiry time.Duration) TokenSource`

### Parameters
- **t** (\*Token) - The initial token to reuse.
- **src** (TokenSource) - The source to obtain new tokens from when the cached token is invalid.
- **earlyExpiry** (time.Duration) - The duration to subtract from the token's expiry time to determine when to refresh.

### Returns
- **TokenSource** - A TokenSource that reuses the token with a configurable expiry buffer.

## StaticTokenSource

### Description
StaticTokenSource returns a TokenSource that always returns the same token. Because the provided token t is never refreshed, StaticTokenSource is only useful for tokens that never expire.

### Signature
`func StaticTokenSource(t *Token) TokenSource`

### Parameters
- **t** (\*Token) - The token to always return.

### Returns
- **TokenSource** - A TokenSource that always returns the same token.

## Transport

### Description
Transport is an http.RoundTripper that makes OAuth 2.0 HTTP requests, wrapping a base http.RoundTripper and adding an Authorization header with a token from the supplied TokenSource. Transport is a low-level mechanism. Most code will use the higher-level Config.Client method instead.

### Fields
- **Source** (TokenSource) - Supplies the token to add to outgoing requests' Authorization headers.
- **Base** (http.RoundTripper) - The base RoundTripper used to make HTTP requests. If nil, http.DefaultTransport is used.

### Methods
#### CancelRequest

##### Description
CancelRequest does nothing. It used to be a legacy cancellation mechanism but now only logs on first use to warn that it's deprecated. Deprecated: use contexts for cancellation instead.

##### Signature
`func (t *Transport) CancelRequest(req *http.Request)`

##### Parameters
- **req** (*http.Request) - The request to cancel.

```

--------------------------------

### Config

Source: https://pkg.go.dev/golang.org/x/oauth2/jwt

Config is the configuration for using JWT to fetch tokens, commonly known as 'two-legged OAuth 2.0'. It contains fields for email, private key, token URL, scopes, and other options.

```APIDOC
## Config

### Description
Config is the configuration for using JWT to fetch tokens, commonly known as "two-legged OAuth 2.0".

### Fields
- **Email** (string) - OAuth client identifier used when communicating with the configured OAuth provider.
- **PrivateKey** ([]byte) - Contents of an RSA private key or a PEM file containing a private key. Used to sign JWT payloads. PEM containers with a passphrase are not supported.
- **PrivateKeyID** (string) - Optional hint indicating which key is being used.
- **Subject** (string) - Optional user to impersonate.
- **Scopes** ([]string) - Optional list of requested permission scopes.
- **TokenURL** (string) - Endpoint required to complete the 2-legged JWT flow.
- **Expires** (time.Duration) - Optional duration for token validity.
- **Audience** (string) - Optional intended audience. If empty, TokenURL is used.
- **PrivateClaims** (map[string]any) - Optional custom private claims in the JWT.
- **UseIDToken** (bool) - Optional flag to use ID token instead of access token when the server returns both.

### Example
go
// Example usage of Config

```

--------------------------------

### OAuth2 Config and AuthCodeOption

Source: https://pkg.go.dev/golang.org/x/oauth2

Documentation for the OAuth2 client configuration and authorization URL generation.

```APIDOC
### AuthCodeOption

```go
type AuthCodeOption interface {
	// contains filtered or unexported methods
}
```

An AuthCodeOption is passed to Config.AuthCodeURL.

### AuthStyle

```go
type AuthStyle int
```

AuthStyle represents how requests for tokens are authenticated to the server.

### Config

```go
type Config struct {
	ClientID string
	ClientSecret string
	Endpoint Endpoint
}
```

Config represents the configuration of an OAuth2 client.

### Config.AuthCodeURL

```go
func (c *Config) AuthCodeURL(state string, opts ...AuthCodeOption) string
```

AuthCodeURL returns a URL to OAuth 2.0 provider's consent page that asks for permissions for the required scopes explicitly.

State is an opaque value used by the client to maintain state between the request and callback. The authorization server includes this value when redirecting the user agent back to the client.

Opts may include AccessTypeOnline or AccessTypeOffline, as well as ApprovalForce.

To protect against CSRF attacks, opts should include a PKCE challenge (S256ChallengeOption). Not all servers support PKCE. An alternative is to generate a random state parameter and verify it after exchange. See https://datatracker.ietf.org/doc/html/rfc6749#section-10.12 (predating PKCE), https://www.oauth.com/oauth2-servers/pkce/ and https://www.ietf.org/archive/id/draft-ietf-oauth-v2-1-09.html#name-cross-site-request-forgery (describing both approaches)

### Config.Client

```go
func (c *Config) Client(ctx context.Context, t *Token) *http.Client
```

Client returns an HTTP client using the provided token. The token will auto-refresh as necessary. The underlying HTTP transport will be obtained using the provided context. The returned client and its Transport should not be modified.

### S256ChallengeOption

```go
func S256ChallengeOption(verifier string) AuthCodeOption
```

S256ChallengeOption derives a PKCE code challenge from the verifier with method S256. It should be passed to Config.AuthCodeURL or Config.DeviceAuth only.

### SetAuthURLParam

```go
func SetAuthURLParam(key, value string) AuthCodeOption
```

SetAuthURLParam sets an additional parameter to be included in the authorization URL.

### AuthStyleAutoDetect

```go
const AuthStyleAutoDetect AuthStyle = 0
```

AuthStyleAutoDetect means to auto-detect which authentication style the provider wants by trying both ways and caching the successful way for the future.

### AuthStyleInParams

```go
const AuthStyleInParams AuthStyle = 1
```

AuthStyleInParams sends the client credentials in the request parameters.

### AuthStyleInHeader

```go
const AuthStyleInHeader AuthStyle = 2
```

AuthStyleInHeader sends the client credentials in the HTTP header.

### AccessTypeOnline

```go
var AccessTypeOnline AuthCodeOption
```

AccessTypeOnline is the default if neither is specified. If your application needs to refresh access tokens when the user is not present, use AccessTypeOffline.

### AccessTypeOffline

```go
var AccessTypeOffline AuthCodeOption
```

AccessTypeOffline requests that the authorization server return a refresh token.

### ApprovalForce

```go
var ApprovalForce AuthCodeOption
```

ApprovalForce forces the consent page to be displayed even if the user has previously granted permissions.
```

--------------------------------

### Credentials struct definition

Source: https://pkg.go.dev/golang.org/x/oauth2/google

Holds project ID, token source, and raw JSON credentials. The JSON field may be nil when authentication is provided by the environment.

```go
type Credentials struct {
	ProjectID   string // may be empty
	TokenSource oauth2.TokenSource

	// JSON contains the raw bytes from a JSON credentials file.
	// This field may be nil if authentication is provided by the
	// environment and not with a credentials file, e.g. when code is
	// running on Google Cloud Platform.
	JSON []byte
```

--------------------------------

### Config TokenSource method signature

Source: https://pkg.go.dev/golang.org/x/oauth2/google/internal/externalaccountauthorizeduser

Declares the TokenSource method on Config, which returns an oauth2.TokenSource and an error.

```go
func (c *Config) TokenSource(ctx context.Context) (oauth2.TokenSource, error)
```

--------------------------------

### Config struct for JWT OAuth2

Source: https://pkg.go.dev/golang.org/x/oauth2/jira

Configuration for two-legged OAuth 2.0 using JWT. BaseURL is the app's base URL and Subject is the Atlassian userkey, not the username.

```go
type Config struct {
	// BaseURL for your app
	BaseURL string

	// Subject is the userkey as defined by Atlassian
	// Different than username (ex: /rest/api/2/user?username=alex)
	Subject string

	oauth2.Config
}
```

--------------------------------

### Shopify function signature

Source: https://pkg.go.dev/golang.org/x/oauth2/endpoints

Returns a new oauth2.Endpoint for the supplied shop domain name. host should be a hostname without any scheme prefix. Added in v0.30.0.

```go
func Shopify(host string) oauth2.Endpoint
```

--------------------------------

### Token.WithExtra method

Source: https://pkg.go.dev/golang.org/x/oauth2

WithExtra returns a new Token that's a clone of t, but using the provided raw extra map. This is only intended for use by packages implementing derivative OAuth2 flows.

```go
func (t *Token) WithExtra(extra any) *Token
```

--------------------------------

### ComputeTokenSource

Source: https://pkg.go.dev/golang.org/x/oauth2/google

Returns a token source that fetches access tokens from Google Compute Engine's metadata server. Only valid on GCE instances.

```APIDOC
## ComputeTokenSource

### Description
Returns a token source that fetches access tokens from Google Compute Engine (GCE)'s metadata server. Only valid when running on a GCE instance.

### Function Signature
`func ComputeTokenSource(account string, scope ...string) oauth2.TokenSource`

### Parameters
- **account** (string) - Required - The service account to use; if empty, "default" is used.
- **scope** (string) - Optional - OAuth 2.0 scopes to request; if none specified, default scopes are granted.

### Returns
- **oauth2.TokenSource** - A token source for GCE metadata server.
```

--------------------------------

### type ExecutableConfig struct

Source: https://pkg.go.dev/golang.org/x/oauth2/google/externalaccount

ExecutableConfig contains information needed for executable sourced credentials. It specifies the command to run, timeout, and optional output file for caching.

```APIDOC
## type ExecutableConfig struct

### Description
ExecutableConfig contains information needed for executable sourced credentials. It specifies the command to run, timeout, and optional output file for caching.

### Fields
- **Command** (string) - Required - The full command to run to retrieve the subject token. This can include arguments. Must be an absolute path for the program.
- **TimeoutMillis** (*int) - Optional - The timeout duration, in milliseconds. Defaults to 30000 milliseconds when not provided.
- **OutputFile** (string) - Optional - The absolute path to the output file where the executable will cache the response. If specified the auth libraries will first check this location before running the executable.
```

--------------------------------

### ClientCredentialsConfigFromCaps function signature

Source: https://pkg.go.dev/golang.org/x/oauth2/hipchat

Generates a clientcredentials.Config from a HipChat API capabilities descriptor. Does not verify scopes against the capabilities document.

```go
func ClientCredentialsConfigFromCaps(capsJSON []byte, clientID, clientSecret string, scopes ...string) (*clientcredentials.Config, error)
```

--------------------------------

### func (c *Config) Token(ctx context.Context) (*oauth2.Token, error)

Source: https://pkg.go.dev/golang.org/x/oauth2/clientcredentials

Token uses client credentials to retrieve a token. The provided context optionally controls which HTTP client is used.

```APIDOC
## func (c *Config) Token(ctx context.Context) (*oauth2.Token, error)

### Description
Token uses client credentials to retrieve a token. The provided context optionally controls which HTTP client is used. See the oauth2.HTTPClient variable.

### Parameters
- **ctx** (context.Context) - The context optionally controls which HTTP client is used.

### Returns
- **oauth2.Token** - The retrieved token.
- **error** - An error if the token retrieval fails.

```

--------------------------------

### RetrieveToken function

Source: https://pkg.go.dev/golang.org/x/oauth2/internal

RetrieveToken retrieves a token from the provider using the given credentials and parameters.

```go
func RetrieveToken(ctx context.Context, clientID, clientSecret, tokenURL string, v url.Values, authStyle AuthStyle, styleCache *AuthStyleCache) (*Token, error)
```

--------------------------------

### func GenerateVerifier() string

Source: https://pkg.go.dev/golang.org/x/oauth2

Generates a PKCE code verifier with 32 octets of randomness. This follows recommendations in RFC 7636. A fresh verifier should be generated for each authorization.

```APIDOC
## func GenerateVerifier() string

### Description
Generates a PKCE code verifier with 32 octets of randomness. This follows recommendations in RFC 7636. A fresh verifier should be generated for each authorization. The resulting verifier should be passed to Config.AuthCodeURL or Config.DeviceAuth with S256ChallengeOption, and to Config.Exchange or Config.DeviceAccessToken with VerifierOption.

### Function Signature
`func GenerateVerifier() string`

### Returns
- **string** - The generated PKCE code verifier.
```

--------------------------------

### SDKConfig.Scopes

Source: https://pkg.go.dev/golang.org/x/oauth2/google

Returns the scopes associated with the SDK config.

```APIDOC
## SDKConfig.Scopes

### Description
Returns the scopes associated with the SDK config.

### Method Signature
`func (c *SDKConfig) Scopes() []string`

### Parameters
- **c** (*SDKConfig) - Required - The SDK config.

### Returns
- **[]string** - The scopes.
```

--------------------------------

### DeviceAuth

Source: https://pkg.go.dev/golang.org/x/oauth2

Returns a device auth struct which contains a device code and authorization information provided for users to enter on another device.

```APIDOC
## DeviceAuth

### Description
Returns a device auth struct which contains a device code and authorization information provided for users to enter on another device.

### Method
DeviceAuth

### Signature
func (c *Config) DeviceAuth(ctx context.Context, opts ...AuthCodeOption) (*DeviceAuthResponse, error)

### Parameters
- **ctx** (context.Context) - Required - The context for the request.
- **opts** (...AuthCodeOption) - Optional - Additional authorization code options.

### Returns
- **deviceAuthResponse** (*DeviceAuthResponse) - The device authorization response.
- **error** (error) - An error if the request fails.
```

--------------------------------

### MediaMathSandbox OAuth2 Endpoint

Source: https://pkg.go.dev/golang.org/x/oauth2/endpoints

Defines the OAuth2 endpoint for MediaMath Sandbox.

```go
var MediaMathSandbox = oauth2.Endpoint{
	AuthURL:  "https://t1sandbox.mediamath.com/oauth2/v1.0/authorize",
	TokenURL: "https://t1sandbox.mediamath.com/oauth2/v1.0/token",
}
```

--------------------------------

### Fitbit endpoint

Source: https://pkg.go.dev/golang.org/x/oauth2/endpoints

Fitbit is the endpoint for Fitbit.

```go
var Fitbit = oauth2.Endpoint{
	AuthURL:  "https://www.fitbit.com/oauth2/authorize",
	TokenURL: "https://api.fitbit.com/oauth2/token",
}

```

--------------------------------

### AppEngineTokenSource

Source: https://pkg.go.dev/golang.org/x/oauth2/google

Returns a token source for App Engine environments, fetching tokens from the service account or metadata server. Deprecated on second generation runtimes and flexible environment.

```APIDOC
## AppEngineTokenSource

### Description
Returns a token source that fetches tokens from either the current application's service account or from the metadata server, depending on the App Engine environment. It is deprecated on second generation runtimes and flexible environment, delegating to ComputeTokenSource.

### Function Signature
`func AppEngineTokenSource(ctx context.Context, scope ...string) oauth2.TokenSource`

### Parameters
- **ctx** (context.Context) - Required - The context, must have come from appengine.NewContext on first generation runtimes.
- **scope** (string) - Optional - OAuth 2.0 scopes to request.

### Returns
- **oauth2.TokenSource** - A token source for App Engine environments.
```
Tokens:
Raw