# @pdsjs/oauth-client

Browser OAuth for public atproto clients. It implements authorization code with
PKCE, pushed authorization requests, DPoP-bound tokens, refresh, revocation and
session storage.

Create one client per application. Supply the application's identity resolver,
requested scope and storage prefix. The prefix lets an application preserve its
existing session keys when it moves to this package.

```js
import { createDpopClient, createOAuthClient } from '@pdsjs/oauth-client';

const dpop = createDpopClient({ databaseName: 'my-app-oauth' });
const oauth = createOAuthClient({
  dpop,
  resolveIdentity,
  scope: 'atproto',
  storagePrefix: 'my-app',
});

await oauth.beginSignIn('alice.example');
```

The `dpop` export provides the same key and proof for credentials other than
OAuth tokens. Its key stays non-extractable in IndexedDB.