oauth

OAuth

[![Version][versioni]][version] [![GitHub tag (latest SemVer)][⛳️tag-img]][⛳️tag] [![License: MIT][license-img]][license] [![Downloads Rank][dl-ranki]][dl-rank] [![CodeCov Test Coverage][codecovi]][codecov] [![Coveralls Test Coverage][coveralls-img]][coveralls] [![QLTY Test Coverage][qlty-covi]][qlty-cov] [![QLTY Maintainability][qlty-mnti]][qlty-mnt] [![CI Heads][3-hd-wfi]][3-hd-wf] [![CI Runtime Dependencies @ HEAD][12-crh-wfi]][12-crh-wf] [![CI Current][11-c-wfi]][11-c-wf] [![CI Truffle Ruby][9-t-wfi]][9-t-wf] [![CI JRuby][10-j-wfi]][10-j-wf] [![Deps Locked][13-️-wfi]][13-️-wf] [![Deps Unlocked][14-️-wfi]][14-️-wf] [![CI Test Coverage][2-cov-wfi]][2-cov-wf] [![CI Style][5-st-wfi]][5-st-wf] [![Apache SkyWalking Eyes License Compatibility Check][15--wfi]][15--wf]

if ci_badges.map(&:color).detect { it != "green"} ☝️ [let me know][✉️discord-invite], as I may have missed the [discord notification][✉️discord-invite].

if ci_badges.map(&:color).all? { it == "green"} ️ send money so I can do more of this. FLOSS maintenance is now my full-time job.

[![OpenCollective Backers][osc-backers-i]][osc-backers] [![OpenCollective Sponsors][osc-sponsors-i]][osc-sponsors] [![Sponsor Me on Github][sponsor-img]][sponsor] [![Liberapay Goal Progress][⛳liberapay-img]][⛳liberapay] [![Donate on PayPal][paypal-img]][paypal] [![Buy me a coffee][buyme-small-img]][buyme] [![Donate at ko-fi.com][kofi-img]][kofi]

How will this project approach the September 2025 hostile takeover of RubyGems? ️

I've summarized my thoughts in this blog post.

Synopsis

OAuth 1.0a is an industry-standard protocol for authorization. It is an update to the original OAuth 1.0 protocol, and is used by many popular services.

This is a RubyGem for implementing OAuth 1.0 or 1.0a clients and servers in Ruby applications. See the sibling oauth2 gem for OAuth 2.0, 2.1, & OIDC clients in Ruby.

All dependencies of this gem are signed, so it can be installed with a HighSecurity profile.

• OAuth 1.0 Spec
• oauth-tty sibling gem is the OAuth 1.0 / 1.0a CLI.
• oauth2 sibling gem for OAuth 2.0 implementations in Ruby.

OAuth 1.0 vs 1.0a: What this library implements

This gem targets the OAuth 1.0a behavior (the errata that became RFC 5849), while maintaining compatibility with providers that still behave like classic 1.0. Here are the key differences between the two and how this gem handles them:

• oauth_callback
  • 1.0: Optional in practice; some providers accepted flows without it.
  • 1.0a: Consumer SHOULD send oauth_callback when obtaining a Request Token, or explicitly use the out-of-band value "oob".
  • This gem: If you do not pass oauth_callback, we default it to "oob" (OUT_OF_BAND). You can opt-out by passing exclude_callback: true.
• oauth_callback_confirmed
  • 1.0: Not specified.
  • 1.0a: Service Provider MUST return oauth_callback_confirmed=true with the Request Token response. This mitigates session fixation.
  • This gem: Parses token responses but does not include oauth_callback_confirmed in the signature base string (it is a response param, not a signed request param).
• oauth_verifier
  • 1.0: Not present.
  • 1.0a: After the user authorizes, the Provider returns an oauth_verifier to the Consumer, and the Consumer MUST include it when exchanging the Request Token for an Access Token.
  • This gem: Supports oauth_verifier across request helpers and request proxies; pass oauth_verifier to get_access_token in 3‑legged flows.

Practical guidance:

• For 3‑legged flows, always supply oauth_callback when calling consumer.get_request_token, and include oauth_verifier when calling request_token.get_access_token.
• For command‑line or non-HTTP clients, use the special OUT_OF_BAND value ("oob") as the oauth_callback and prompt the user to paste back the displayed verifier.

References: RFC 5849 (OAuth 1.0), sections 5–7; 1.0a security errata.

Ruby OAuth has been maintained by a large number of talented individuals over the years. The primary maintainer since 2020 is Peter Boling (@pboling).

Info you can shake a stick at

Compatibility

Compatible with MRI Ruby 2.3+, and concordant releases of JRuby, and TruffleRuby. CI workflows and Appraisals are generated for MRI Ruby 2.4+. This test floor is configured by ruby.test_minimum in .kettle-jem.yml and may be higher than the gem's runtime compatibility floor when legacy Rubies are not practical for the current toolchain.

The amazing test matrix is powered by the kettle-dev stack.

How kettle-dev manages complexity in tests

Federated DVCS

Find this repo on federated forges (Coming soon!)