View Source Ueberauth.Strategy.Orcid.OAuth (ueberauth_orcid v0.3.0)

OAuth2 client for ORCID.

Configure credentials and, when using this module directly, a callback URI:

config :ueberauth, Ueberauth.Strategy.Orcid.OAuth,
  client_id: System.get_env("ORCID_CLIENT_ID"),
  client_secret: System.get_env("ORCID_CLIENT_SECRET"),
  redirect_uri: "https://example.com/auth/orcid/callback"

Credentials must be nonblank strings. The legacy {:system, "ENV_NAME"} credential form is also supported. Invalid configuration raises ArgumentError identifying the key, without including credential values.

Set site: "https://sandbox.orcid.org" to use the sandbox. Authorization and token endpoints are relative to site unless explicitly overridden.

Summary

Types

token_error()

Functions

authorize_url!(params \\ [], opts \\ [])

Builds the authorization URL. :redirect_uri must be supplied in parameters or client configuration; parameters take precedence. opts are client options.

client(opts \\ [])

Builds an OAuth2 client, merging options over application configuration.

get(token, url, headers \\ [], opts \\ [])

Fetches a resource using the access token as bearer authentication.

get_token(params \\ [], options \\ [])

Exchanges a code for {:ok, %OAuth2.AccessToken{}} or {:error, reason}.

get_token!(params \\ [], options \\ [])

Like get_token/2, but returns the token or raises OAuth2.Error with a safe reason. Uses the same top-level header, HTTP and client options.

Types

token_error()

@type token_error() ::
  :token_exchange_failed | :invalid_response | :invalid_json | :invalid_token

Functions

authorize_url!(params \\ [], opts \\ [])

@spec authorize_url!(
  OAuth2.Client.params(),
  keyword()
) :: String.t()

Builds the authorization URL. :redirect_uri must be supplied in parameters or client configuration; parameters take precedence. opts are client options.

client(opts \\ [])

@spec client(keyword()) :: OAuth2.Client.t()

Builds an OAuth2 client, merging options over application configuration.

The default Httpc adapter verifies TLS and uses bounded connection/request timeouts. Explicit request options and custom adapters remain supported.

get(token, url, headers \\ [], opts \\ [])

@spec get(
  OAuth2.AccessToken.t() | String.t(),
  String.t(),
  OAuth2.Client.headers(),
  keyword()
) ::
  {:ok, OAuth2.Response.t()}
  | {:error, OAuth2.Response.t() | OAuth2.Error.t() | token_error()}

Fetches a resource using the access token as bearer authentication.

Headers and HTTP options are forwarded to OAuth2. HTTP errors retain the dependency's response/error tuples; malformed JSON returns a safe error atom.

get_token(params \\ [], options \\ [])

@spec get_token(
  OAuth2.Client.params(),
  keyword()
) :: {:ok, OAuth2.AccessToken.t()} | {:error, token_error()}

Exchanges a code for {:ok, %OAuth2.AccessToken{}} or {:error, reason}.

Options are top-level :headers (HTTP headers), :options (HTTP options), and :client_options (client configuration overrides). :redirect_uri must be provided in parameters or client configuration. Configuration errors raise ArgumentError; provider failures return only safe atoms, never response data.

ORCID uses client_secret_post: credentials are sent in a POST form, not Basic authentication. Authorization headers are removed from token requests and the form content type is enforced. Other supplied headers/options are preserved. Tokens require a nonblank access token and Bearer token type (omission defaults to Bearer). Refresh tokens and expiry are optional; when present, refresh tokens must be nonblank strings and expiry must be a nonnegative integer or its string representation. Legacy expires is accepted when expires_in is absent/null.

get_token!(params \\ [], options \\ [])

@spec get_token!(
  OAuth2.Client.params(),
  keyword()
) :: OAuth2.AccessToken.t()

Like get_token/2, but returns the token or raises OAuth2.Error with a safe reason. Uses the same top-level header, HTTP and client options.