neilberkman
Hi all - I’ve been building Attesto, a set of libraries that brings certified OAuth 2.1 and OpenID Connect to Elixir, whether you want to be an identity provider, talk to one, or put OAuth in front of an MCP server.
It’s OpenID Certified, including FAPI 2.0 (Security Profile and Message Signing), the bank-grade profile behind open banking. As far as I can tell from the OpenID Foundation’s directory, that makes it the first Elixir provider certified for FAPI 2.0. The certs also cover OpenID Connect Basic and Config, all three Logout profiles, Session Management, and FAPI-CIBA, and they run against the Foundation’s conformance suite rather than being self-asserted.
For Phoenix apps, attesto_phoenix is a drop-in authorization server: /authorize, /token, PAR, DPoP, mTLS, PKCE - backed by your own Ecto schemas. You keep your login and consent screens, it handles the protocol.
On the MCP side, the spec now has servers act as OAuth 2.1 resource servers, and attesto_mcp handles that boundary. It protects your /mcp endpoint, publishes the RFC 9728 metadata that lets Claude, ChatGPT, and other MCP clients discover how to authorize, verifies Bearer/DPoP/mTLS tokens locally, and enforces scopes before a request reaches your tools. It drops straight into Anubis, or any Plug/Phoenix MCP server.
If you’re on the client side, attesto_client covers the relying-party work: discovery, JWKS, ID-token and JARM verification, request objects, private_key_jwt.
All of it sits on a small conn-free core with no Phoenix or Ecto assumptions, so you can build on that directly if you’re on a different stack.
Everything’s on Hex with docs, and I’d welcome feedback, especially from anyone doing OAuth for MCP.
Hex: attesto · attesto_phoenix · attesto_client · attesto_mcp
Where Next?
Trending in Announcing
Other Trending Topics
Latest on Elixir Forum
Sponsor Spotlight
Practical resources that improve the lives of professional developers.
Categories:
Sub Categories:
Forums
Popular Tags
- #ecto
- #liveview
- #troubleshooting
- #learning-elixir
- #deployment
- #library
- #erlang
- #testing
- #genserver
- #mix
- #absinthe
- #remote-other
- #otp
- #plug
- #how-to-question
- #macros
- #postgres
- #channels
- #elixirconf
- #exunit
- #discussion
- #code-sync
- #javascript
- #podcasts
- #onsite
- #dialyzer
- #docker
- #authentication
- #umbrella
- #full-time-contract
- #podcasts-by-brainlid
- #ecto-query
- #elixir-ls
- #blog-post
- #phoenix_html
- #iex
- #graphql
- #ai
- #genstage
- #elixirconf-us
- #websockets
- #supervisor
- #advent-of-code
- #distillery
- #processes
- #api
- #forms
- #metaprogramming
- #security
- #hex
Our Sponsors
Build Elixir applications with speed and confidence.
Supporting innovation across the BEAM ecosystem.
We build reliable cloud platforms for business-critical systems.
Catch errors, track performance, monitor hosts and more.
Error tracking, logs, uptime, and Just Enough APM. Built for developers.
Producing high quality Elixir screencasts since 2017.
Enabling companies to succeed by building software people love.
The deployment platform built for Elixir: PaaS ease, VPS control.
The team behind Membrane, Popcorn, LiveDebugger. Available for hire.
Courses that'll move you from confusion to "Aha, now I get it!"
Showing Posts 1 to 1- Show Best Posts
- Show All Posts (oldest first)
- Show All Posts (newest first)
neilberkman
Several updates since the initial announcement.
Most of this falls under OpenID for Verifiable Credentials (OID4VC), the protocols behind the EU Digital Identity Wallet, across all three specified roles:
attesto_phoenixmounts the issuance endpoints; after your own auth/consent you hand a wallet a credential as SD-JWT VC, ISO 18013-5 mdoc, orjwt_vc_json. For when you’re the one attesting something: a PID/eID provider, a university issuing diplomas, a bank issuing an account credential.attesto_client: take a credential offer, prove the holder key, request and verify the credential, then present it back to a verifier.Targets the High Assurance Interoperability Profile (HAIP) and runs green against the OpenID Foundation’s OID4VCI/OID4VP conformance suites. Those suites are still alpha so these are not new certifications yet.
A few things outside the wallet work:
attesto_clientis now OpenID Certified as a Relying Party (Basic/Config/Dynamic) — the client side is certified now too, not just the provider.attesto_mcppicked up that per-resource confinement plus multi-resource routing: host several OAuth-protected MCP servers behind one app, each with tokens scoped to it. (It’s the auth boundary in front of your MCP server; the transport/streaming stays with your server lib, e.g.anubis_mcp.)There’s also been substantial hardening and correctness fixes across the releases. I recommend updating when convenient, but nothing is critical.
Latest versions are attesto 1.8.0, attesto_phoenix 2.7.0, attesto_client 2.3.0, attesto_mcp 1.0.5.