Overview | Browser binding and deployment boundary | Provider metadata and OIDC discovery | JWT client authentication | Issuer comparison and transport policy | Callback pages and application scripts | Provider key-set validation | Trusted ID-token audiences | Mutual TLS (mTLS) | JWT-secured authorization request (JAR) | Request Objects published by the Shiny app | Pushed authorization requests (PAR) | Form Post response mode | Deployment behind an HTTPS proxy | JWT-secured authorization response mode (JARM) | Demonstrating proof-of-possession (DPoP) | Token binding requirements and validation | DPoP in API requests | Signature and encryption support

Logging | Validation and URL policy | Advanced parameter overrides | Async timeout (mirai) | Async condition replay | Token lifetime fallback | HTTP settings (timeout, retries, user agent) | State store | Size caps | State envelope | Callback query | Local debugging

Overview | GitHub app registration | Minimal Shiny module example | Provider, client, and token objects | Authentication state and user information | Manual login and logout buttons | Authenticated API requests | Additional token response fields | Provider configuration and OIDC discovery | Assessing OAuth 2.1 configuration | Multiple authorization servers | Requests bound to a client and resource | Asynchronous execution | Token expiry and session length | Deployment | Posit Connect and Connect Cloud | Multiple R processes | Security checklist | Troubleshooting | Further configuration

Overview | Exporter configuration | Traces and event correlation | Logging and tracing options | Asynchronous workers | Error attributes and redaction | Authorization metadata privacy | Span catalog | Span: shinyOAuth.module.init | Span: shinyOAuth.login.request | Span: shinyOAuth.login.par | Span: shinyOAuth.login.par.http | Span: shinyOAuth.callback | Span: shinyOAuth.form_post | Span: shinyOAuth.form_post.bridge | Span: shinyOAuth.callback.validate | Span: shinyOAuth.callback.worker | Span: shinyOAuth.token.exchange | Span: shinyOAuth.token.exchange.http | Span: shinyOAuth.token.verify | Span: shinyOAuth.userinfo | Span: shinyOAuth.userinfo.http | Span: shinyOAuth.refresh | Span: shinyOAuth.refresh.worker | Span: shinyOAuth.logout | Span: shinyOAuth.session.end.revoke | Span: shinyOAuth.token.revoke | Span: shinyOAuth.token.revoke.http | Span: shinyOAuth.token.revoke.worker | Span: shinyOAuth.token.introspect | Span: shinyOAuth.token.introspect.http | Span: shinyOAuth.token.introspect.worker

Overview | What happens during the authentication flow? | 1. First page load: set a browser token | 2. Decide whether to start login | 3. Build the authorization request | State storage and expiry | Signed and pushed authorization requests (JAR and PAR) | 4. Redirect the browser to the provider | 5. User signs in and authorizes access | 6. Provider returns the browser to the app | HTTP POST callbacks (form_post) | Signed authorization responses (JARM) | 7. Validate the callback and login state | Browser binding and account validation | Multiple authorization servers | 8. Exchange the authorization code for tokens | Client certificates and certificate-bound tokens (mTLS) | Tokens bound to a signing key (DPoP) | 9. Validate the ID token (OIDC) | Signature and claim checks | Requested claims and authentication context (ACR) | 10. Build the OAuthToken object | 11. Check whether the token is active (optional introspection) | 12. Fetch user information (optional) | Signed UserInfo responses | UserInfo with mTLS or DPoP | 13. Mark the session as authenticated | 14. Clean up the callback URL and browser state | 15. Manage the authenticated session | Token refresh | ID tokens during refresh | Refreshing mTLS and DPoP tokens | Reauthentication | Expiry and refresh failures | 16. Logout and token revocation

Overview | Spotify app registration | Shiny app example | API requests and scopes | Full dashboard example

Client configuration and connections | Register two clients | 1. Configure clients outside server() | 2. Keep authorizations when the browser returns | 3. Select a connection and make a request | Requests, permissions and refresh | Keep an ordinary OIDC login alongside SMART connections

Overview | Receiving audit events | Authentication outcomes | Event structure | HTTP context and redaction | Audit events from asynchronous workers | Digest keys across R processes | Event catalog | Authorization redirect issuance | Event: audit_redirect_issued | Callback query rejected | Event: audit_callback_query_rejected | Callback routing rejected | Event: audit_callback_routing_rejected | Callback issuer validation | Event: audit_callback_iss_missing | Event: audit_callback_iss_mismatch | Event: audit_callback_iss_validation_failed | Callback received | Event: audit_callback_received | Callback validation | Event: audit_callback_validation_success | Event: audit_callback_validation_failed | State store access | Event: audit_state_store_lookup_failed | Event: audit_state_store_removal_failed | Token exchange | Event: audit_token_exchange | Event: audit_token_exchange_error | Token introspection | Event: audit_token_introspection | Login result | Event: audit_login_success | Event: audit_login_failed | Logout and session clears | Event: audit_logout | Event: audit_connection_disconnected | Event: audit_connections_disconnected | Event: audit_session_cleared | Token revocation | Event: audit_token_revocation | Refresh failures while keeping the session (indefinite sessions) | Event: audit_refresh_failed_but_kept_session | Browser cookie/WebCrypto error | Event: audit_browser_cookie_error | Invalid browser token | Event: audit_invalid_browser_token | Token refresh | Event: audit_token_refresh | Userinfo fetch | Event: audit_userinfo | State parsing failures | Event: audit_state_parse_failure | Error response state consumption | Event: audit_error_state_consumed | Event: audit_error_state_consumption_failed | Module/session lifecycle | Event: audit_session_started | Event: audit_session_ended | Event: audit_session_ended_revoke | Authentication state changes | Event: audit_authenticated_changed | Error events | Event: error | Event: http_error | Event: transport_error

A single-authorization app | SDK callbacks and databases | Refresh, async work and recovery | Several authorizations and optional UserInfo | Background tasks and result ownership

Declare calendar and contacts targets | Use the same connection interface in either module | Microsoft configuration

Callbacks and chat ownership | Schemas and tool results | Documents and uploaded files | Structured streams | Stream events and recovery | Request limits and observability | Tools followed by structured extraction | Async, parallel and batch boundaries

Choose a reading method | Discover the data source once | Read with SQL | Read one table without writing a query | Read Eventhouse data | Query a semantic model with DAX | Read a OneLake file | Read through GraphQL or Spark | Scale up with Arrow streams

Find and connect to a Lakehouse | List and read ordinary files | Write or upload a file | Discover and read managed tables | Write an R object as a managed table | Turn existing files into a table | Read a large or historical Delta table

Find and connect to a Warehouse | Prepare a staging Lakehouse for writes | Add rows to an existing table | Replace table data | Scale up with Arrow | More information

Choose a destination | Prepare a small R data frame | Write a Lakehouse table | Write an ordinary OneLake file | Write a Warehouse table | Write an Eventhouse table | Load a file that is already in a Lakehouse | Scale up with Arrow

The Fabric objects you will see | Sign in | Find a workspace and an item | Complete a first read | Choose the next guide

Find a KQL database | Write a small data frame in one call | Queue a tracked batch | Wait and inspect the outcome | Scale up with Arrow | Export a large KQL result to OneLake

Before the first call | Run one piece of Spark code | Choose the language that matches the code | Reuse a session for several statements | Submit a complete application file | Use an Environment for repeatable configuration

Query the model with DAX | Check access before refreshing | Refresh after an upstream update | Use enhanced refresh controls | Diagnose attempts and failures | Inspect history | More information

Run once and inspect history | Build schedule configurations | Create, list, update, and disable | Delete a schedule

FHIR and SMART on FHIR | Before running the example | 1. Discover the server and configure the client | 2. Configure retained connections | 3. Authorize and fetch the patient | Search with the same connection | Patient context and user identity are different | Start from an EHR instead | More than one hospital | Other registration and refresh options

Run a first query | Inspect the available fields | Read more than one page | Build an analysis-ready tibble | Treat incomplete pagination as partial data

Lifecycle | Prepare the function in Fabric | Make a first call | Send structured parameters | Retry only safe functions | Limits | More information

Quick start: sign in as yourself | 1. Find your tenant ID | 2. Set the tenant ID in R | 3. Test the connection | 4. Save the settings for future R sessions | Make sure Fabric access has been granted | First-login troubleshooting | How authentication works | Treat endpoint URLs as credential boundaries | Choosing an advanced authentication method | Advanced: authentication for automation | Service principal with a client secret | Managed identities and custom token providers | Set Fabric permissions by workload | Signing out (token cache)

Setup an LLM provider | Basic prompting | Prompt wraps | answer_as: Retrieving output in a specific format | JSON output | answer_by: Adding a reasoning mode to the LLM | answer_using: Have the LLM work with tools and code | Tools (function-calling) | Code generation and evaluation | Creating custom prompt wraps | Provider-level prompt wraps

Example

Breaking out of the evaluation loop | Extraction versus validation functions | Prompt wrap types and order of application | Configuring a LLM provider with a prompt wrap | Configuring a prompt wrap based on the LLM provider or HTTP responses | Configuring a prompt wrap based on other prompt wraps | Handler functions