Glossary

The terms below appear across the storage, token and registration pages. Each entry is short; follow the link for the full treatment.

Storage

Term	Meaning
Substore	One narrow interface under store.Store that owns one kind of record: clients, authorization codes, sessions, and so on. A backend implements the substores; the OP decides which must be non-nil from the configuration. See Bring your own store backend.
Atomic-routing cluster	The substores that must commit in one transaction (authorization codes, refresh tokens, grants, PAR records, access-token registries and grant revocations), so they have to live on the same backend. The composite store refuses a configuration that splits them. See Hot/cold split.
Grant	The record of one subject's authorization to one client. Every authorization of that pair rewrites it, and tokens are issued under it, so revoking the grant retires them. See Per-authorization state and refresh chains.
Grant tombstone	A small per-grant revocation row. Under the default strategy a JWT access token carries its grant ID, and verification consults the tombstone instead of a row per token. See JWT access-token revocation strategy.
JTI	The jti claim (RFC 7519 §4.1.7): a unique identifier for one JWT. See Clock and replay.
Consumed JTI	A marker recording that a JWT's jti was accepted, kept until the JWT's own expiry so a replay is refused. DPoP proof replay detection uses it. See Clock and replay.
Lockout store	The store.AuthnLockoutStore that persists the per-subject failure counter shared by the password and second-factor steps. op.New refuses a login flow that counts failures when none resolves. See Authentication and login flow.

Sign-in

Term	Meaning
Interaction	The server-side record of one in-progress /authorize request while the user signs in or consents. The interaction driver renders its current prompt. See SPA / custom interaction.
Login flow	The authentication chain passed to op.WithLoginFlow: a primary step that binds the user, optional second factors, and rules that add a step for some clients, scopes or risk levels. It is the only way to compose browser authentication. See Authentication and login flow.
UI mode	How the OP renders its login, consent and chooser pages, chosen with one op.WithUI call: op.HTMLUI (embedder templates), op.SPAUI (the OP mounts a single-page app) or op.DriverUI (your own interaction.Driver). See SPA / custom interaction.
Chooser group	The set of sessions one browser is signed into, kept by the OP so a user can switch or add accounts. See Multi-account.

Requests and tokens

Term	Meaning
PAR / request_uri	Pushed Authorization Requests (RFC 9126): the client posts the authorization request to /par and receives a short-lived, single-use request_uri to send to /authorize in its place. See Authorization Code + PKCE.
Sender-constrained token	An access token bound to a key the client must prove it holds, so a leaked token is useless alone. The binding is DPoP or mTLS. See Sender constraint.
DPoP	Demonstrating Proof-of-Possession (RFC 9449): the client signs a proof with its own key on each request, and the token is bound to that key's thumbprint. See DPoP.
ACR / AAL	acr names the authentication context a login satisfied; the built-in policy maps it to an assurance level (op.AAL1 to op.AAL3, canonical URIs from op.AAL2.ACRURI()). op.WithACRPolicy(op.ACRLevels{...}) declares custom values. See MFA / step-up.
First-party client	A static or admin-managed client listed in op.WithFirstPartyClients that skips the consent screen. The grant is still recorded as consent.granted.first_party. See Consent.
DPoP nonce source	The op.WithDPoPNonceSource value that issues the server-supplied DPoP-Nonce (RFC 9449 §8). Replicas must share one source. See DPoP.
Profile	A named security posture passed to WithProfile, such as profile.OAuth21 (the default), profile.OIDCCore or profile.FAPI2Baseline. It switches on the features the profile requires and makes op.New refuse settings it forbids. See Declaring a security profile.
Network reach (private network option)	The WithAllowPrivateNetwork option. By default the OP refuses to fetch from, or deliver to, loopback, link-local and private addresses on behalf of a relying party (an SSRF boundary). Each op.Outbound* target lifts that for one fetcher, for relying parties that live on a private network; it is legitimate in production, and op.New logs it. See mTLS / proxy / network.

Dynamic registration

Term	Meaning
IAT (initial access token)	A token the operator issues to authorize creating clients at /register (RFC 7591), with a use ceiling and an expiry. See Dynamic Client Registration.
RAT (registration access token)	The token returned when a client registers, which authorizes reading, updating or deleting that one registration (RFC 7592). See Dynamic Client Registration.