Problem
The current high-level OAuth client owns a loopback callback server, browser launch, and optional terminal input. That works well for local CLI applications, but applications with their own HTTP callback routing cannot use the package without reimplementing the authorization request and token exchange.
Requested capability
Expose lower-level, composable OAuth primitives that support:
- a caller-provided redirect URI;
- caller-managed state and PKCE lifecycle;
- authorization URL creation without opening a browser or starting a listener;
- authorization-code exchange without terminal or callback-server ownership;
- the existing validated API-key and expiration result shape.
Keep the current loopback client as a convenience API composed from the same primitives.
Acceptance criteria
- Hosted and loopback redirect URIs are supported through public APIs.
- Authorization and exchange inputs are validated consistently.
- Token responses and error bodies retain current validation and safe error handling.
- PKCE and state values are never logged or included in thrown messages.
- Unit tests cover successful exchange, mismatched inputs, malformed responses, and endpoint failures.
- Public documentation includes local-loopback and caller-managed examples.
Problem
The current high-level OAuth client owns a loopback callback server, browser launch, and optional terminal input. That works well for local CLI applications, but applications with their own HTTP callback routing cannot use the package without reimplementing the authorization request and token exchange.
Requested capability
Expose lower-level, composable OAuth primitives that support:
Keep the current loopback client as a convenience API composed from the same primitives.
Acceptance criteria