# OAuth server

> Storage for an OAuth 2.1 authorization server: registered clients (RFC 7591) with hashed secrets, a grant per user and client, single-use authorization codes bound to a PKCE S256 challenge, device codes (RFC 8628) and a revocation list of access token jtis. It issues no tokens. createOAuthServer() in better-supabase/blocks/oauth-server hashes secrets and checks PKCE, and its isRevoked plugs into accessTokenResolver.

- Category: Developer platform
- Module: `oauth-server`
- Modes: `managed`
- Docs: https://bettersupabase.com/docs/blocks/oauth-server
- Page: https://bettersupabase.com/blocks/oauth-server

## Install

```bash
npx better-supabase add oauth-server
```

## Configure

Add the block to `better-supabase.config.ts`:

```ts
import { defineConfig } from "better-supabase/config";

export default defineConfig({
  blocks: {
    // Modes: "managed". The default is "managed".
    "oauth-server": { mode: "managed" },
  },
});
```

## Client

The block has no React entry yet. Its server-side TypeScript is in `better-supabase/blocks/oauth-server`.

## Events

- `oauth_client.deleted`
- `oauth_client.registered`
- `oauth_grant.created`
- `oauth_grant.revoked`

## Related blocks

Works with: [outbox](https://bettersupabase.com/blocks/outbox.md), [audit](https://bettersupabase.com/blocks/audit.md)