masks

https://github.com/masksrb/masks

Discovery, PKCE authorization, token exchange, and token verification against a masks issuer, with Rack middleware for a resource server and a Rails engine that mounts the consumer half of the code flow. The auth server itself stays standalone.