% Generated by roxygen2: do not edit by hand
% Please edit documentation in R/auth.R
\name{sync_token}
\alias{sync_token}
\title{Obtain an OIDC token interactively}
\usage{
sync_token(
  client_id = Sys.getenv("OIDC_CLIENT_ID"),
  client_secret = Sys.getenv("OIDC_CLIENT_SECRET"),
  issuer = oidc_issuer(),
  scopes = "openid email",
  redirect_uri = oauth_redirect_uri()
)
}
\arguments{
\item{client_id}{The OIDC client ID (application ID). Defaults to the
\code{OIDC_CLIENT_ID} environment variable.}

\item{client_secret}{The OIDC client secret. Required by Google (Desktop
app) and "Web application" client types; leave unset for native / public
clients, which authenticate via PKCE alone. Defaults to the
\code{OIDC_CLIENT_SECRET} environment variable.}

\item{issuer}{The OIDC issuer URL. Defaults to the \code{OIDC_ISSUER}
environment variable, falling back to Google
(\code{"https://accounts.google.com"}).}

\item{scopes}{Space-separated OAuth scopes to request. Default
\code{"openid email"}.}

\item{redirect_uri}{Local redirect URI for the OAuth callback. Defaults to
\code{\link[httr2:oauth_redirect_uri]{httr2::oauth_redirect_uri()}}, i.e. \code{"http://localhost"} with an
OS-assigned random port (or the \code{HTTR2_OAUTH_REDIRECT_URL} environment
variable on hosted platforms). Supply an explicit port (e.g.
\code{"http://localhost:8080"}) when your OIDC provider requires the redirect
URI to match a pre-registered value.}
}
\value{
A JWT (ID token) as a character string.
}
\description{
Performs the OAuth 2.0 Authorization Code flow with PKCE to obtain a JWT
(ID token) from an OIDC provider, delegating the browser handshake and token
exchange to \pkg{httr2}. Endpoints are discovered from the issuer's
\code{.well-known} metadata via \code{\link[httr2:oauth_server_metadata]{httr2::oauth_server_metadata()}}, and the flow is
run by \code{\link[httr2:oauth_flow_auth_code]{httr2::oauth_flow_auth_code()}}: it opens the system browser, listens
on a loopback redirect for the callback, and returns the ID token for use
with \code{\link[=sync_fetch]{sync_fetch()}}.
}
\details{
For Google, register the OAuth client as a "Desktop app" and set both
\code{OIDC_CLIENT_ID} and \code{OIDC_CLIENT_SECRET}. Google's Desktop app secret is
required in the token exchange but, unlike a "Web application" secret, is
not treated as confidential: Google states that for installed apps "the
client secret is obviously not treated as a secret"
(\url{https://developers.google.com/identity/protocols/oauth2#installed}),
consistent with the OAuth 2.0 for Native Apps standard
(RFC 8252 section 8.5,
\url{https://datatracker.ietf.org/doc/html/rfc8252#section-8.5}).
Providers that support native / public clients (Microsoft Entra, Okta,
Auth0, etc.) need only \code{client_id}, authenticating via PKCE alone; leave
\code{client_secret} unset for these.
}
\examples{
\dontshow{if (interactive()) withAutoprint(\{ # examplesIf}
# Uses OIDC_CLIENT_ID and OIDC_CLIENT_SECRET env vars by default
token <- sync_token()

# Or supply credentials directly
token <- sync_token(
  client_id = "YOUR_CLIENT_ID.apps.googleusercontent.com",
  client_secret = "YOUR_CLIENT_SECRET"
)

# Use with sync_fetch
doc <- sync_fetch(server$url, "myDocId", token = token, tls = tls)
\dontshow{\}) # examplesIf}
}
