You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: README.md
+2-5Lines changed: 2 additions & 5 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -10,12 +10,9 @@ The Kinde SDK for Go.
10
10
11
11
Requires Go 1.24+
12
12
13
-
### Usage
13
+
##OAuth 2.0 Flows
14
14
15
-
```bash
16
-
go get github.com/kinde-oss/kinde-go
17
-
go mod tidy
18
-
```
15
+
For comprehensive information about OAuth 2.0 flows and how to choose the right flow for your application, see [OAuth 2.0 flows explained](https://kinde.com/learn/authentication/protocols/oauth-flows-explained/).
Copy file name to clipboardExpand all lines: jwt/README.md
+23-3Lines changed: 23 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -2,6 +2,20 @@
2
2
3
3
The `jwt` package provides comprehensive JWT (JSON Web Token) parsing, validation, and management capabilities for the Kinde Go SDK. This package is designed to work seamlessly with OAuth2 flows and provides flexible validation options.
4
4
5
+
## Learn More About JWTs
6
+
7
+
To better understand JSON Web Tokens, their structure, security features, and use cases, check out our comprehensive guide:
8
+
9
+
**[A complete guide to JSON Web Tokens (JWTs)](https://kinde.com/learn/authentication/types-and-methods/json-web-tokens/)**
10
+
11
+
This guide covers:
12
+
13
+
- What JSON Web Tokens are and how they work
14
+
- JWT structure (header, payload, signature)
15
+
- Security considerations and best practices
16
+
- Common use cases for authentication and authorization
17
+
- JWT benefits compared to other token types
18
+
5
19
## Features
6
20
7
21
-**Multiple Parsing Methods**: Parse JWT tokens from HTTP headers, strings, session storage, or OAuth2 tokens
@@ -10,10 +24,12 @@ The `jwt` package provides comprehensive JWT (JSON Web Token) parsing, validatio
10
24
-**Comprehensive Token Access**: Easy access to token claims, subject, issuer, audience, and other standard JWT fields
**Important**: All validation options (e.g., `WillValidateWithJWKSUrl`, `WillValidateAlgorithm`, `WillValidateAudience`) are applied **once during token parsing**, not every time the token is read. The validation results are cached in the token object, so subsequent calls to `GetSubject()`, `GetIssuer()`, `GetAudience()`, etc. do not re-validate the token.
61
+
62
+
**Note for OAuth2 Flows**: When using the JWT package with OAuth2 flows (authorization_code or client_credentials), tokens are **re-validated every time they are retrieved from the token source**. This ensures that tokens remain valid throughout their lifecycle and any validation errors are caught when tokens are refreshed or retrieved from session storage.
The authorization code flow is a backend authorization flow that requires a client secret. It is designed to be used as a server-side auth flow and does not expose tokens to the browser. User sessions need to be managed by other means, for example via session cookies.
The client credentials flow is designed for machine-to-machine communication which doesn't involve human input. It requires a Kinde M2M application and is ideal for server-to-server authentication scenarios.
0 commit comments