@better-auth/core 1.7.0-beta.1 → 1.7.0-beta.10

package/dist/oauth2/refresh-access-token.d.mts

@@ -1,61 +1,41 @@
-import { ClientAssertionConfig } from "./client-assertion.mjs";
 import { AwaitableFunction } from "../types/helper.mjs";
 import { OAuth2Tokens, ProviderOptions } from "./oauth-provider.mjs";
+import { TokenEndpointAuth, TokenEndpointSecretAuthentication } from "./token-endpoint-auth.mjs";
 
 //#region src/oauth2/refresh-access-token.d.ts
-declare function refreshAccessTokenRequest({
-  refreshToken,
-  options,
-  authentication,
-  clientAssertion,
-  tokenEndpoint,
-  extraParams,
-  resource
-}: {
+interface RefreshAccessTokenRequestInput {
   refreshToken: string;
   options: AwaitableFunction<Partial<ProviderOptions>>;
-  authentication?: ("basic" | "post" | "private_key_jwt") | undefined;
-  clientAssertion?: ClientAssertionConfig | undefined; /** Token endpoint URL. Used as the JWT `aud` claim when signing assertions. */
+  authentication?: TokenEndpointSecretAuthentication | undefined;
+  tokenEndpointAuth?: TokenEndpointAuth | undefined;
   tokenEndpoint?: string | undefined;
   extraParams?: Record<string, string> | undefined;
   resource?: (string | string[]) | undefined;
-}): Promise<{
-  body: URLSearchParams;
-  headers: Record<string, any>;
-}>;
-/**
- * @deprecated use async'd refreshAccessTokenRequest instead
- */
-declare function createRefreshAccessTokenRequest({
+}
+interface RefreshAccessTokenInput extends RefreshAccessTokenRequestInput {
+  options: Partial<ProviderOptions>;
+  tokenEndpoint: string;
+}
+declare function refreshAccessTokenRequest({
   refreshToken,
   options,
   authentication,
+  tokenEndpointAuth,
+  tokenEndpoint,
   extraParams,
   resource
-}: {
-  refreshToken: string;
-  options: ProviderOptions;
-  authentication?: ("basic" | "post" | "private_key_jwt") | undefined;
-  extraParams?: Record<string, string> | undefined;
-  resource?: (string | string[]) | undefined;
-}): {
+}: RefreshAccessTokenRequestInput): Promise<{
   body: URLSearchParams;
-  headers: Record<string, any>;
-};
+  headers: Record<string, string>;
+}>;
 declare function refreshAccessToken({
   refreshToken,
   options,
   tokenEndpoint,
   authentication,
-  clientAssertion,
-  extraParams
-}: {
-  refreshToken: string;
-  options: Partial<ProviderOptions>;
-  tokenEndpoint: string;
-  authentication?: ("basic" | "post" | "private_key_jwt") | undefined;
-  clientAssertion?: ClientAssertionConfig | undefined;
-  extraParams?: Record<string, string> | undefined;
-}): Promise<OAuth2Tokens>;
+  tokenEndpointAuth,
+  extraParams,
+  resource
+}: RefreshAccessTokenInput): Promise<OAuth2Tokens>;
 //#endregion
-export { createRefreshAccessTokenRequest, refreshAccessToken, refreshAccessTokenRequest };
+export { refreshAccessToken, refreshAccessTokenRequest };

package/dist/oauth2/refresh-access-token.mjs

@@ -1,33 +1,41 @@
-import { resolveAssertionParams } from "./client-assertion.mjs";
-import { base64 } from "@better-auth/utils/base64";
-import { betterFetch } from "@better-fetch/fetch";
+import { parseScopeField } from "./utils.mjs";
+import { fetchRefusingRedirects } from "./reject-redirects.mjs";
+import { applyTokenEndpointAuth } from "./token-endpoint-auth.mjs";
 //#region src/oauth2/refresh-access-token.ts
-async function refreshAccessTokenRequest({ refreshToken, options, authentication, clientAssertion, tokenEndpoint, extraParams, resource }) {
+const BLOCKED_REFRESH_TOKEN_PARAMS_SET = new Set([
+	"grant_type",
+	"refresh_token",
+	"__proto__",
+	"constructor",
+	"prototype"
+]);
+async function refreshAccessTokenRequest({ refreshToken, options, authentication, tokenEndpointAuth, tokenEndpoint, extraParams, resource }) {
 	options = typeof options === "function" ? await options() : options;
-	if (authentication === "private_key_jwt") {
-		if (!clientAssertion) throw new Error("private_key_jwt authentication requires a clientAssertion configuration");
-		const assertionParams = await resolveAssertionParams({
-			clientAssertion,
-			clientId: Array.isArray(options.clientId) ? options.clientId[0] : options.clientId,
-			tokenEndpoint
-		});
-		extraParams = {
-			...extraParams,
-			...assertionParams
-		};
-	}
-	return createRefreshAccessTokenRequest({
+	const request = buildRefreshAccessTokenRequest({
 		refreshToken,
 		options,
-		authentication,
 		extraParams,
 		resource
 	});
+	await applyTokenEndpointAuth({
+		body: request.body,
+		headers: request.headers,
+		options,
+		tokenEndpoint: tokenEndpoint ?? "",
+		grantType: "refresh_token",
+		tokenEndpointAuth,
+		authentication
+	});
+	return request;
 }
-/**
-* @deprecated use async'd refreshAccessTokenRequest instead
-*/
-function createRefreshAccessTokenRequest({ refreshToken, options, authentication, extraParams, resource }) {
+function applyRefreshExtraParams(body, extraParams) {
+	if (!extraParams) return;
+	for (const [key, value] of Object.entries(extraParams)) {
+		if (BLOCKED_REFRESH_TOKEN_PARAMS_SET.has(key)) continue;
+		body.set(key, value);
+	}
+}
+function buildRefreshAccessTokenRequest({ refreshToken, options, extraParams, resource }) {
 	const body = new URLSearchParams();
 	const headers = {
 		"content-type": "application/x-www-form-urlencoded",
@@ -35,31 +43,25 @@ function createRefreshAccessTokenRequest({ refreshToken, options, authentication
 	};
 	body.set("grant_type", "refresh_token");
 	body.set("refresh_token", refreshToken);
-	const primaryClientId = Array.isArray(options.clientId) ? options.clientId[0] : options.clientId;
-	if (authentication === "basic") if (primaryClientId) headers["authorization"] = "Basic " + base64.encode(`${primaryClientId}:${options.clientSecret ?? ""}`);
-	else headers["authorization"] = "Basic " + base64.encode(`:${options.clientSecret ?? ""}`);
-	else {
-		body.set("client_id", primaryClientId);
-		if (authentication !== "private_key_jwt" && options.clientSecret) body.set("client_secret", options.clientSecret);
-	}
 	if (resource) if (typeof resource === "string") body.append("resource", resource);
 	else for (const _resource of resource) body.append("resource", _resource);
-	if (extraParams) for (const [key, value] of Object.entries(extraParams)) body.set(key, value);
+	if (extraParams) applyRefreshExtraParams(body, extraParams);
 	return {
 		body,
 		headers
 	};
 }
-async function refreshAccessToken({ refreshToken, options, tokenEndpoint, authentication, clientAssertion, extraParams }) {
+async function refreshAccessToken({ refreshToken, options, tokenEndpoint, authentication, tokenEndpointAuth, extraParams, resource }) {
 	const { body, headers } = await refreshAccessTokenRequest({
 		refreshToken,
 		options,
 		authentication,
-		clientAssertion,
+		tokenEndpointAuth,
 		tokenEndpoint,
-		extraParams
+		extraParams,
+		resource
 	});
-	const { data, error } = await betterFetch(tokenEndpoint, {
+	const { data, error } = await fetchRefusingRedirects(tokenEndpoint, {
 		method: "POST",
 		body,
 		headers
@@ -69,7 +71,7 @@ async function refreshAccessToken({ refreshToken, options, tokenEndpoint, authen
 		accessToken: data.access_token,
 		refreshToken: data.refresh_token,
 		tokenType: data.token_type,
-		scopes: data.scope?.split(" "),
+		scopes: parseScopeField(data.scope),
 		idToken: data.id_token
 	};
 	if (data.expires_in) {
@@ -83,4 +85,4 @@ async function refreshAccessToken({ refreshToken, options, tokenEndpoint, authen
 	return tokens;
 }
 //#endregion
-export { createRefreshAccessTokenRequest, refreshAccessToken, refreshAccessTokenRequest };
+export { refreshAccessToken, refreshAccessTokenRequest };

package/dist/oauth2/reject-redirects.mjs

@@ -0,0 +1,65 @@
+import { BetterAuthError } from "../error/index.mjs";
+import { betterFetch } from "@better-fetch/fetch";
+//#region src/oauth2/reject-redirects.ts
+const httpRedirectStatuses = new Set([
+	301,
+	302,
+	303,
+	307,
+	308
+]);
+/**
+* Whether a response from a `redirect: "manual"` fetch is a redirect.
+*
+* Node/undici exposes the real 3xx status. Spec-compliant runtimes (Cloudflare
+* Workers, Deno, browsers) return an opaque-redirect filtered response with
+* status 0 and type `"opaqueredirect"`, so the status alone is not enough.
+*/
+function isRedirectResponse(response) {
+	return response.type === "opaqueredirect" || httpRedirectStatuses.has(response.status);
+}
+function redirectRefused(endpoint) {
+	return new BetterAuthError(`The OAuth endpoint "${endpoint}" returned an HTTP redirect. Server-side OAuth fetches refuse redirects to prevent SSRF; configure the final endpoint URL.`);
+}
+/**
+* Fetch option that refuses HTTP redirects portably.
+*
+* Cloudflare Workers (workerd) rejects `redirect: "error"`, so manual mode is
+* used and the resolved response is checked with {@link assertResponseNotRedirect}
+* (or, for betterFetch, with {@link fetchRefusingRedirects}).
+*/
+const noFollowRedirect = { redirect: "manual" };
+/**
+* Throw when a native-`fetch` response (e.g. jose's JWKS loader) resolved to a
+* redirect, so an attacker-influenced endpoint cannot bounce a server-side
+* request to an internal address.
+*/
+function assertResponseNotRedirect(endpoint, response) {
+	if (isRedirectResponse(response)) throw redirectRefused(endpoint);
+}
+/**
+* betterFetch that refuses HTTP redirects on a server-side OAuth fetch.
+*
+* Returns the betterFetch result and throws if the endpoint redirected, on both
+* undici (real 3xx status) and spec-compliant runtimes (opaque redirect, where
+* the error status is 0). The redirect is never followed on any runtime.
+*/
+async function fetchRefusingRedirects(url, options) {
+	let redirected = false;
+	const onError = options?.onError;
+	const result = await betterFetch(url, {
+		...options,
+		...noFollowRedirect,
+		async onError(context) {
+			if (isRedirectResponse(context.response)) redirected = true;
+			await onError?.(context);
+		}
+	}).catch((error) => {
+		if (redirected) throw redirectRefused(url);
+		throw error;
+	});
+	if (redirected) throw redirectRefused(url);
+	return result;
+}
+//#endregion
+export { assertResponseNotRedirect, fetchRefusingRedirects, noFollowRedirect };

package/dist/oauth2/token-endpoint-auth.d.mts

@@ -0,0 +1,17 @@
+import { ClientAssertionGetter } from "./client-assertion.mjs";
+
+//#region src/oauth2/token-endpoint-auth.d.ts
+type TokenEndpointAuth = {
+  method: "none";
+} | {
+  method: "client_secret_basic";
+} | {
+  method: "client_secret_post";
+} | {
+  method: "private_key_jwt";
+  getClientAssertion: ClientAssertionGetter;
+};
+type TokenEndpointAuthMethod = TokenEndpointAuth["method"];
+type TokenEndpointSecretAuthentication = "basic" | "post";
+//#endregion
+export { TokenEndpointAuth, TokenEndpointAuthMethod, TokenEndpointSecretAuthentication };

package/dist/oauth2/token-endpoint-auth.mjs

@@ -0,0 +1,89 @@
+import { getPrimaryClientId } from "./utils.mjs";
+import { encodeBasicCredentials } from "./basic-credentials.mjs";
+import { resolveClientAssertionParams } from "./client-assertion.mjs";
+//#region src/oauth2/token-endpoint-auth.ts
+function getDefaultTokenEndpointAuth(options, authentication) {
+	if (authentication === "basic") return { method: "client_secret_basic" };
+	if (options.clientSecret) return { method: "client_secret_post" };
+	return { method: "none" };
+}
+function assertNoClientSecret(method, options, body) {
+	if (options.clientSecret || body.has("client_secret")) throw new Error(`${method} token endpoint authentication cannot be combined with clientSecret`);
+}
+function setClientId(body, clientId) {
+	if (clientId) body.set("client_id", clientId);
+}
+function assertClientSecretConfigured(method, options) {
+	if (!options.clientSecret) throw new Error(`${method} token endpoint authentication requires clientSecret`);
+}
+function assertClientIdConfigured(method, clientId) {
+	if (!clientId) throw new Error(`${method} token endpoint authentication requires clientId`);
+}
+function setClientSecretPostAuth({ body, options, clientId, requireClientSecret }) {
+	if (requireClientSecret) assertClientSecretConfigured("client_secret_post", options);
+	if (options.clientSecret) {
+		assertClientIdConfigured("client_secret_post", clientId);
+		setClientId(body, clientId);
+		body.set("client_secret", options.clientSecret);
+	}
+}
+function setClientSecretBasicAuth({ headers, options, clientId, body }) {
+	if (body.has("client_secret")) throw new Error("client_secret_basic token endpoint authentication cannot be combined with client_secret body parameters");
+	assertClientSecretConfigured("client_secret_basic", options);
+	assertClientIdConfigured("client_secret_basic", clientId);
+	headers.authorization = encodeBasicCredentials(clientId, options.clientSecret);
+}
+function assertCompleteManualClientAssertion(body) {
+	if (body.has("client_assertion") !== body.has("client_assertion_type")) throw new Error("client_assertion and client_assertion_type must both be provided");
+}
+async function applyTokenEndpointAuth({ body, headers, options, tokenEndpoint, grantType, tokenEndpointAuth, authentication }) {
+	assertCompleteManualClientAssertion(body);
+	const clientId = getPrimaryClientId(options.clientId);
+	if (body.has("client_assertion")) {
+		if (tokenEndpointAuth) throw new Error("client_assertion body parameters cannot be combined with tokenEndpointAuth");
+		assertNoClientSecret("private_key_jwt", options, body);
+		setClientId(body, clientId);
+		return;
+	}
+	const auth = tokenEndpointAuth ?? getDefaultTokenEndpointAuth(options, authentication);
+	if (auth.method === "private_key_jwt") {
+		assertNoClientSecret(auth.method, options, body);
+		assertClientIdConfigured(auth.method, clientId);
+		if (!tokenEndpoint) throw new Error("private_key_jwt token endpoint authentication requires tokenEndpoint");
+		const assertionParams = await resolveClientAssertionParams({
+			getClientAssertion: auth.getClientAssertion,
+			context: {
+				clientId,
+				tokenEndpoint,
+				grantType
+			}
+		});
+		setClientId(body, clientId);
+		for (const [key, value] of Object.entries(assertionParams)) body.set(key, value);
+		return;
+	}
+	if (auth.method === "none") {
+		assertNoClientSecret(auth.method, options, body);
+		if (grantType === "client_credentials") throw new Error("none token endpoint authentication cannot be used with client_credentials grant");
+		assertClientIdConfigured(auth.method, clientId);
+		setClientId(body, clientId);
+		return;
+	}
+	if (auth.method === "client_secret_basic") {
+		setClientSecretBasicAuth({
+			headers,
+			options,
+			clientId,
+			body
+		});
+		return;
+	}
+	setClientSecretPostAuth({
+		body,
+		options,
+		clientId,
+		requireClientSecret: tokenEndpointAuth?.method === "client_secret_post"
+	});
+}
+//#endregion
+export { applyTokenEndpointAuth };

package/dist/oauth2/utils.d.mts

@@ -2,6 +2,28 @@ import { OAuth2Tokens } from "./oauth-provider.mjs";
 
 //#region src/oauth2/utils.d.ts
 declare function getOAuth2Tokens(data: Record<string, any>): OAuth2Tokens;
+/**
+ * Fill in `accessTokenExpiresAt` from the provider's configured
+ * `accessTokenExpiresIn` when the token response omitted `expires_in`. Without a
+ * known expiry, `getAccessToken` cannot tell the token is expired and never
+ * refreshes it. No-op when the provider already supplied an expiry or no
+ * fallback is configured.
+ */
+declare function applyDefaultAccessTokenExpiry(tokens: OAuth2Tokens, accessTokenExpiresIn: number | undefined): OAuth2Tokens;
+/**
+ * Compute the union of stored and incoming OAuth scopes, preserving
+ * stored insertion order and dropping duplicates.
+ */
+declare function mergeScopes(stored: string | null | undefined, incoming: string[] | undefined): string;
+/**
+ * Return the provider's primary Client ID: the single string, or the entry at
+ * array index 0 for the cross-platform form used by ID token audience
+ * verification. Index 0 is the designated primary and pairs with
+ * `clientSecret` for the authorization code flow; later array entries are
+ * only used as additional accepted audiences. Returns `undefined` when the
+ * primary value is missing or an empty string.
+ */
+declare function getPrimaryClientId(clientId: unknown): string | undefined;
 declare function generateCodeChallenge(codeVerifier: string): Promise<string>;
 //#endregion
-export { generateCodeChallenge, getOAuth2Tokens };
+export { applyDefaultAccessTokenExpiry, generateCodeChallenge, getOAuth2Tokens, getPrimaryClientId, mergeScopes };

package/dist/oauth2/utils.mjs

@@ -1,5 +1,19 @@
 import { base64Url } from "@better-auth/utils/base64";
 //#region src/oauth2/utils.ts
+/**
+* Parse a provider's `scope` token-response field into a string array.
+*
+* RFC 6749 Section 3.3 defines `scope` as a space-delimited string, but
+* providers vary: some return an already-split array. Accept both forms and
+* drop empty or non-string entries.
+*
+* @see https://github.com/better-auth/better-auth/issues/9076
+*/
+function parseScopeField(scope) {
+	if (Array.isArray(scope)) return scope.map((s) => typeof s === "string" ? s.trim() : "").filter(Boolean);
+	if (typeof scope === "string") return scope.trim().split(/\s+/).filter(Boolean);
+	return [];
+}
 function getOAuth2Tokens(data) {
 	const getDate = (seconds) => {
 		const now = /* @__PURE__ */ new Date();
@@ -11,15 +25,47 @@ function getOAuth2Tokens(data) {
 		refreshToken: data.refresh_token,
 		accessTokenExpiresAt: data.expires_in ? getDate(data.expires_in) : void 0,
 		refreshTokenExpiresAt: data.refresh_token_expires_in ? getDate(data.refresh_token_expires_in) : void 0,
-		scopes: data?.scope ? typeof data.scope === "string" ? data.scope.split(" ") : data.scope : [],
+		scopes: parseScopeField(data.scope),
 		idToken: data.id_token,
 		raw: data
 	};
 }
+/**
+* Fill in `accessTokenExpiresAt` from the provider's configured
+* `accessTokenExpiresIn` when the token response omitted `expires_in`. Without a
+* known expiry, `getAccessToken` cannot tell the token is expired and never
+* refreshes it. No-op when the provider already supplied an expiry or no
+* fallback is configured.
+*/
+function applyDefaultAccessTokenExpiry(tokens, accessTokenExpiresIn) {
+	if (!tokens.accessTokenExpiresAt && accessTokenExpiresIn) tokens.accessTokenExpiresAt = new Date(Date.now() + accessTokenExpiresIn * 1e3);
+	return tokens;
+}
+/**
+* Compute the union of stored and incoming OAuth scopes, preserving
+* stored insertion order and dropping duplicates.
+*/
+function mergeScopes(stored, incoming) {
+	const existing = stored ? stored.split(",").map((scope) => scope.trim()).filter(Boolean) : [];
+	const next = (incoming ?? []).map((scope) => scope.trim()).filter(Boolean);
+	return [...new Set([...existing, ...next])].join(",");
+}
+/**
+* Return the provider's primary Client ID: the single string, or the entry at
+* array index 0 for the cross-platform form used by ID token audience
+* verification. Index 0 is the designated primary and pairs with
+* `clientSecret` for the authorization code flow; later array entries are
+* only used as additional accepted audiences. Returns `undefined` when the
+* primary value is missing or an empty string.
+*/
+function getPrimaryClientId(clientId) {
+	const value = Array.isArray(clientId) ? clientId[0] : clientId;
+	return typeof value === "string" && value.length > 0 ? value : void 0;
+}
 async function generateCodeChallenge(codeVerifier) {
 	const data = new TextEncoder().encode(codeVerifier);
 	const hash = await crypto.subtle.digest("SHA-256", data);
 	return base64Url.encode(new Uint8Array(hash), { padding: false });
 }
 //#endregion
-export { generateCodeChallenge, getOAuth2Tokens };
+export { applyDefaultAccessTokenExpiry, generateCodeChallenge, getOAuth2Tokens, getPrimaryClientId, mergeScopes, parseScopeField };

package/dist/oauth2/validate-authorization-code.d.mts

@@ -1,64 +1,41 @@
-import { ClientAssertionConfig } from "./client-assertion.mjs";
 import { AwaitableFunction } from "../types/helper.mjs";
 import { OAuth2Tokens, ProviderOptions } from "./oauth-provider.mjs";
+import { TokenEndpointAuth, TokenEndpointSecretAuthentication } from "./token-endpoint-auth.mjs";
 import * as jose from "jose";
 
 //#region src/oauth2/validate-authorization-code.d.ts
-declare function authorizationCodeRequest({
-  code,
-  codeVerifier,
-  redirectURI,
-  options,
-  authentication,
-  clientAssertion,
-  tokenEndpoint,
-  deviceId,
-  headers,
-  additionalParams,
-  resource
-}: {
+interface AuthorizationCodeRequestInput {
   code: string;
   redirectURI: string;
   options: AwaitableFunction<Partial<ProviderOptions>>;
   codeVerifier?: string | undefined;
   deviceId?: string | undefined;
-  authentication?: ("basic" | "post" | "private_key_jwt") | undefined;
-  clientAssertion?: ClientAssertionConfig | undefined; /** Token endpoint URL. Used as the JWT `aud` claim when signing assertions. */
+  authentication?: TokenEndpointSecretAuthentication | undefined;
+  tokenEndpointAuth?: TokenEndpointAuth | undefined;
   tokenEndpoint?: string | undefined;
   headers?: Record<string, string> | undefined;
   additionalParams?: Record<string, string> | undefined;
   resource?: (string | string[]) | undefined;
-}): Promise<{
-  body: URLSearchParams;
-  headers: Record<string, any>;
-}>;
-/**
- * @deprecated use async'd authorizationCodeRequest instead
- */
-declare function createAuthorizationCodeRequest({
+}
+interface ValidateAuthorizationCodeInput extends AuthorizationCodeRequestInput {
+  tokenEndpoint: string;
+}
+declare function authorizationCodeRequest({
   code,
   codeVerifier,
   redirectURI,
   options,
   authentication,
+  tokenEndpointAuth,
+  tokenEndpoint,
   deviceId,
   headers,
   additionalParams,
   resource
-}: {
-  code: string;
-  redirectURI: string;
-  options: Partial<ProviderOptions>;
-  codeVerifier?: string | undefined;
-  deviceId?: string | undefined;
-  authentication?: ("basic" | "post" | "private_key_jwt") | undefined;
-  headers?: Record<string, string> | undefined;
-  additionalParams?: Record<string, string> | undefined;
-  resource?: (string | string[]) | undefined;
-}): {
+}: AuthorizationCodeRequestInput): Promise<{
   body: URLSearchParams;
-  headers: Record<string, any>;
-};
+  headers: Record<string, string>;
+}>;
 declare function validateAuthorizationCode({
   code,
   codeVerifier,
@@ -66,27 +43,15 @@ declare function validateAuthorizationCode({
   options,
   tokenEndpoint,
   authentication,
-  clientAssertion,
+  tokenEndpointAuth,
   deviceId,
   headers,
   additionalParams,
   resource
-}: {
-  code: string;
-  redirectURI: string;
-  options: AwaitableFunction<Partial<ProviderOptions>>;
-  codeVerifier?: string | undefined;
-  deviceId?: string | undefined;
-  tokenEndpoint: string;
-  authentication?: ("basic" | "post" | "private_key_jwt") | undefined;
-  clientAssertion?: ClientAssertionConfig | undefined;
-  headers?: Record<string, string> | undefined;
-  additionalParams?: Record<string, string> | undefined;
-  resource?: (string | string[]) | undefined;
-}): Promise<OAuth2Tokens>;
+}: ValidateAuthorizationCodeInput): Promise<OAuth2Tokens>;
 declare function validateToken(token: string, jwksEndpoint: string, options?: {
   audience?: string | string[];
   issuer?: string | string[];
 }): Promise<jose.JWTVerifyResult<jose.JWTPayload> & jose.ResolvedKey>;
 //#endregion
-export { authorizationCodeRequest, createAuthorizationCodeRequest, validateAuthorizationCode, validateToken };
+export { authorizationCodeRequest, validateAuthorizationCode, validateToken };