# OAuth Module Advanced Scenarios

This document lists patterns for customising the OAuth scaffolding generated by RapidKit.

## Rotating Client Credentials

Keep client secrets outside of source control. Augment the generated runtime with a helper that
pulls credentials from your secrets manager. Because the runtime code is deterministic, you can
refresh credentials without regenerating templates.

## Supporting Multiple Providers

The default configuration targets a single provider. Expand the provider registry to include
multiple entries (for example Google, GitHub, Azure AD) and expose a `get_provider(name)` helper
inside `src/auth/oauth.py`. Pair it with dynamic callback routing so each provider maintains an
isolated state parameter and redirect URI.

## PKCE Enforcement

Add PKCE support by generating a `code_verifier` and `code_challenge` before redirecting the user to
the provider. Store the verifier in the session and supply the challenge inside the authorisation
URL. The scaffolder leaves space in the router stub to perform this logic.

## Distributed Deployments

Persist authorisation state across nodes using your central session backend (Redis, DynamoDB, etc.).
The generated session module pairs well with OAuth; share the same signing key to avoid token skew.
