dpop_flutter library

HTTP-client-agnostic OAuth 2.0 DPoP (RFC 9449) for Dart and Flutter.

This library only produces Authorization/DPoP headers - it never sends an HTTP request itself. Use package:dpop_flutter_http or package:dpop_flutter_dio to wire it into a specific HTTP client, or attach the headers manually to any client.

Classes

AccessTokenProvider
Supplies the current OAuth access token to a DPoP-aware HTTP adapter.
DpopClient
The main entry point of dpop_flutter.
DpopClock
Provides the current time to every part of dpop_flutter that needs a timestamp (iat claim generation, proof-expiry checks).
DpopJwk
A public EC (P-256) JSON Web Key, as embedded in the jwk field of a DPoP proof's JOSE header (RFC 9449 §4.2) and used to compute the JWK Thumbprint (RFC 7638).
DpopKeyPair
A DPoP key pair: a private signing key plus the public DpopJwk derived from it at generation time.
DpopKeyStore
Persists a DpopKeyPair across app restarts.
DpopNonceStore
Persists DPoP nonces (RFC 9449 §8) issued by servers via the DPoP-Nonce response header.
InMemoryDpopNonceStore
The default DpopNonceStore: keeps nonces in memory, scoped per origin (scheme + host + port).
SecureDpopKeyStore
The default DpopKeyStore: persists the key pair via flutter_secure_storage, which is backed by Keychain (iOS/macOS), Keystore-encrypted SharedPreferences (Android), DPAPI (Windows), or libsecret (Linux).
SystemDpopClock
The default DpopClock, backed by the system wall clock.

Exceptions / Errors

DpopConfigurationException
The DpopClient was configured or used incorrectly (for example, calling DpopClient.createHeaders before DpopClient.initialize completes).
DpopCryptoException
The underlying CryptoProvider failed (key generation, signing, or hashing failure at the platform-crypto layer).
DpopException
Base type for every error dpop_flutter throws.
DpopKeyException
Key generation, loading, or storage failed (corrupt key, unsupported algorithm, secure storage unavailable, and similar failures).
DpopNonceException
A nonce could not be read from, or written to, a DpopNonceStore.
DpopProofException
DPoP proof construction or signing failed (invalid JWK, invalid JWT, invalid encoding, missing required claim, and similar failures).
DpopStorageException
A DpopKeyStore failed to persist or retrieve data.
DpopValidationException
An input supplied by the caller was invalid (unsupported HTTP method, invalid URI, and similar failures). Never a server- or network-side failure - those belong to the HTTP client, not to dpop_flutter.