auth-foundation/com.okta.authfoundation.client/OAuth2ClientBuilder

OAuth2ClientBuilder

class OAuth2ClientBuilder

Builder for creating an OAuth2Client.

Use the create factory method to construct an instance.

Pass the base org URL as issuerUrl and optionally set authorizationServerId to target a custom authorization server. The effective issuer URL used for OIDC discovery is derived as:

No authorizationServerId: issuerUrl is used as-is (org authorization server).
With authorizationServerId: "$issuerUrl/oauth2/$authorizationServerId" (custom authorization server).

// Org authorization server
val orgClient = OAuth2ClientBuilder.create(
    issuerUrl = "https://your-okta-domain.okta.com",
    clientId = "your-client-id",
    scope = listOf("openid", "profile", "offline_access"),
).getOrThrow()

// Custom authorization server
val customClient = OAuth2ClientBuilder.create(
    issuerUrl = "https://your-okta-domain.okta.com",
    clientId = "your-client-id",
    scope = listOf("openid", "profile", "offline_access"),
) {
    authorizationServerId = "default"
}.getOrThrow()

Types

object Companion

Properties

accessTokenValidator

var accessTokenValidator: AccessTokenValidator

Access token validator. When set, access tokens are validated via at_hash claim.

var acrValues: String?

Optional ACR values.

allowPushedAuthorizationRequestFallback

var allowPushedAuthorizationRequestFallback: Boolean

Allows browser-based authorization flows to fall back to the classic authorization URL when PAR is optional and unavailable/fails.

var apiExecutor: ApiExecutor

The HTTP executor used for all network requests.

authorizationServerId

var authorizationServerId: String?

Optional authorization server ID.

var cache: Cache

The cache for optimizing network calls.

clientAssertionProvider

var clientAssertionProvider: ClientAssertionProvider?

Optional provider for private_key_jwt (or similar JWT-based) client authentication.

var clientSecret: String

Optional client secret for confidential clients.

var clock: OidcClock

The clock used for time-related operations.

computeDispatcher

var computeDispatcher: ERROR CLASS: Symbol not found for CoroutineContext

The dispatcher for compute-bound operations.

deviceSecretValidator

var deviceSecretValidator: DeviceSecretValidator

Device secret validator. When set, device secrets are validated via ds_hash claim.

enablePushedAuthorizationRequests

var enablePushedAuthorizationRequests: Boolean

Enables Pushed Authorization Requests (PAR) for browser-based authorization flows.

endpointOverrides

var endpointOverrides: OAuth2EndpointOverrides?

Optional per-endpoint URL overrides.

idTokenValidator

var idTokenValidator: IdTokenValidator

ID token validator. When set, ID tokens are validated after token refresh.

var ioDispatcher: ERROR CLASS: Symbol not found for CoroutineContext

The dispatcher for IO-bound operations.

var json: ERROR CLASS: Symbol not found for Json

The JSON serializer for encoding/decoding responses.

rateLimitRetryCallback

var rateLimitRetryCallback: (retryCount: Int) -> RateLimitRetryConfig??

Optional callback invoked when an HTTP 429 rate-limit response is received.