diff --git a/CHANGELOG.md b/CHANGELOG.md
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,6 +1,11 @@
-## [*Unreleased*](https://github.com/thoughtbot/yesod-auth-oauth2/compare/v0.6.1.4...master)
+## [*Unreleased*](https://github.com/thoughtbot/yesod-auth-oauth2/compare/v0.6.1.5...master)
 
 None
+
+## [v0.6.1.5](https://github.com/thoughtbot/yesod-auth-oauth2/compare/v0.6.1.4...v0.6.1.5)
+
+- Update to GHC-8.8, and hoauth2-1.14
+- Drop CI-backed support for GHC-8.4
 
 ## [v0.6.1.4](https://github.com/thoughtbot/yesod-auth-oauth2/compare/v0.6.1.3...v0.6.1.4)
 
diff --git a/README.md b/README.md
--- a/README.md
+++ b/README.md
@@ -92,7 +92,7 @@
   where
     oauth2 = OAuth2
         { oauthClientId = clientId
-        , oauthClientSecret = clientSecret
+        , oauthClientSecret = Just clientSecret
         , oauthOAuthorizeEndpoint = "https://mysite.com/oauth/authorize"
         , oauthAccessTokenEndpoint = "https://mysite.com/oauth/token"
         , oauthCallback = Nothing
diff --git a/src/Yesod/Auth/OAuth2/AzureAD.hs b/src/Yesod/Auth/OAuth2/AzureAD.hs
--- a/src/Yesod/Auth/OAuth2/AzureAD.hs
+++ b/src/Yesod/Auth/OAuth2/AzureAD.hs
@@ -9,7 +9,8 @@
 module Yesod.Auth.OAuth2.AzureAD
     ( oauth2AzureAD
     , oauth2AzureADScoped
-    ) where
+    )
+where
 
 import Prelude
 import Yesod.Auth.OAuth2.Prelude
@@ -17,8 +18,7 @@
 newtype User = User Text
 
 instance FromJSON User where
-    parseJSON = withObject "User" $ \o -> User
-        <$> o .: "mail"
+    parseJSON = withObject "User" $ \o -> User <$> o .: "mail"
 
 pluginName :: Text
 pluginName = "azuread"
@@ -32,8 +32,11 @@
 oauth2AzureADScoped :: YesodAuth m => [Text] -> Text -> Text -> AuthPlugin m
 oauth2AzureADScoped scopes clientId clientSecret =
     authOAuth2 pluginName oauth2 $ \manager token -> do
-        (User userId, userResponse) <-
-            authGetProfile pluginName manager token "https://graph.microsoft.com/v1.0/me"
+        (User userId, userResponse) <- authGetProfile
+            pluginName
+            manager
+            token
+            "https://graph.microsoft.com/v1.0/me"
 
         pure Creds
             { credsPlugin = pluginName
@@ -43,11 +46,13 @@
   where
     oauth2 = OAuth2
         { oauthClientId = clientId
-        , oauthClientSecret = clientSecret
-        , oauthOAuthorizeEndpoint = "https://login.windows.net/common/oauth2/authorize" `withQuery`
-            [ scopeParam "," scopes
-            , ("resource", "https://graph.microsoft.com")
-            ]
-        , oauthAccessTokenEndpoint = "https://login.windows.net/common/oauth2/token"
+        , oauthClientSecret = Just clientSecret
+        , oauthOAuthorizeEndpoint =
+            "https://login.windows.net/common/oauth2/authorize"
+                `withQuery` [ scopeParam "," scopes
+                            , ("resource", "https://graph.microsoft.com")
+                            ]
+        , oauthAccessTokenEndpoint =
+            "https://login.windows.net/common/oauth2/token"
         , oauthCallback = Nothing
         }
diff --git a/src/Yesod/Auth/OAuth2/BattleNet.hs b/src/Yesod/Auth/OAuth2/BattleNet.hs
--- a/src/Yesod/Auth/OAuth2/BattleNet.hs
+++ b/src/Yesod/Auth/OAuth2/BattleNet.hs
@@ -11,7 +11,8 @@
 module Yesod.Auth.OAuth2.BattleNet
     ( oauth2BattleNet
     , oAuth2BattleNet
-    ) where
+    )
+where
 
 import Yesod.Auth.OAuth2.Prelude
 
@@ -21,8 +22,7 @@
 newtype User = User Int
 
 instance FromJSON User where
-    parseJSON = withObject "User" $ \o -> User
-        <$> o .: "id"
+    parseJSON = withObject "User" $ \o -> User <$> o .: "id"
 
 pluginName :: Text
 pluginName = "battle.net"
@@ -38,7 +38,10 @@
     authOAuth2Widget widget pluginName oauth2 $ \manager token -> do
         (User userId, userResponse) <-
             authGetProfile pluginName manager token
-                $ fromRelative "https" (apiHost $ T.toLower region) "/account/user"
+                $ fromRelative
+                      "https"
+                      (apiHost $ T.toLower region)
+                      "/account/user"
 
         pure Creds
             { credsPlugin = pluginName
@@ -49,7 +52,7 @@
     host = wwwHost $ T.toLower region
     oauth2 = OAuth2
         { oauthClientId = clientId
-        , oauthClientSecret = clientSecret
+        , oauthClientSecret = Just clientSecret
         , oauthOAuthorizeEndpoint = fromRelative "https" host "/oauth/authorize"
         , oauthAccessTokenEndpoint = fromRelative "https" host "/oauth/token"
         , oauthCallback = Nothing
@@ -64,6 +67,7 @@
 wwwHost "cn" = "www.battlenet.com.cn"
 wwwHost region = Host $ encodeUtf8 $ region <> ".battle.net"
 
-oAuth2BattleNet :: YesodAuth m => Text -> Text -> Text -> WidgetFor m () -> AuthPlugin m
+oAuth2BattleNet
+    :: YesodAuth m => Text -> Text -> Text -> WidgetFor m () -> AuthPlugin m
 oAuth2BattleNet i s r w = oauth2BattleNet w r i s
 {-# DEPRECATED oAuth2BattleNet "Use oauth2BattleNet" #-}
diff --git a/src/Yesod/Auth/OAuth2/Bitbucket.hs b/src/Yesod/Auth/OAuth2/Bitbucket.hs
--- a/src/Yesod/Auth/OAuth2/Bitbucket.hs
+++ b/src/Yesod/Auth/OAuth2/Bitbucket.hs
@@ -9,7 +9,8 @@
 module Yesod.Auth.OAuth2.Bitbucket
     ( oauth2Bitbucket
     , oauth2BitbucketScoped
-    ) where
+    )
+where
 
 import Yesod.Auth.OAuth2.Prelude
 
@@ -18,8 +19,7 @@
 newtype User = User Text
 
 instance FromJSON User where
-    parseJSON = withObject "User" $ \o -> User
-        <$> o .: "uuid"
+    parseJSON = withObject "User" $ \o -> User <$> o .: "uuid"
 
 pluginName :: Text
 pluginName = "bitbucket"
@@ -33,8 +33,11 @@
 oauth2BitbucketScoped :: YesodAuth m => [Text] -> Text -> Text -> AuthPlugin m
 oauth2BitbucketScoped scopes clientId clientSecret =
     authOAuth2 pluginName oauth2 $ \manager token -> do
-        (User userId, userResponse) <-
-            authGetProfile pluginName manager token "https://api.bitbucket.com/2.0/user"
+        (User userId, userResponse) <- authGetProfile
+            pluginName
+            manager
+            token
+            "https://api.bitbucket.com/2.0/user"
 
         pure Creds
             { credsPlugin = pluginName
@@ -50,10 +53,11 @@
   where
     oauth2 = OAuth2
         { oauthClientId = clientId
-        , oauthClientSecret = clientSecret
-        , oauthOAuthorizeEndpoint = "https://bitbucket.com/site/oauth2/authorize" `withQuery`
-            [ scopeParam "," scopes
-            ]
-        , oauthAccessTokenEndpoint = "https://bitbucket.com/site/oauth2/access_token"
+        , oauthClientSecret = Just clientSecret
+        , oauthOAuthorizeEndpoint =
+            "https://bitbucket.com/site/oauth2/authorize"
+                `withQuery` [scopeParam "," scopes]
+        , oauthAccessTokenEndpoint =
+            "https://bitbucket.com/site/oauth2/access_token"
         , oauthCallback = Nothing
         }
diff --git a/src/Yesod/Auth/OAuth2/ErrorResponse.hs b/src/Yesod/Auth/OAuth2/ErrorResponse.hs
--- a/src/Yesod/Auth/OAuth2/ErrorResponse.hs
+++ b/src/Yesod/Auth/OAuth2/ErrorResponse.hs
@@ -9,7 +9,8 @@
     , ErrorName(..)
     , onErrorResponse
     , unknownError
-    ) where
+    )
+where
 
 import Data.Foldable (traverse_)
 import Data.Text (Text)
@@ -65,10 +66,10 @@
 checkErrorResponse = do
     merror <- lookupGetParam "error"
 
-    for merror $ \err -> ErrorResponse
-        <$> pure (readErrorName err)
-        <*> lookupGetParam "error_description"
-        <*> lookupGetParam "error_uri"
+    for merror $ \err ->
+        ErrorResponse (readErrorName err)
+            <$> lookupGetParam "error_description"
+            <*> lookupGetParam "error_uri"
 
 readErrorName :: Text -> ErrorName
 readErrorName "invalid_request" = InvalidRequest
diff --git a/src/Yesod/Auth/OAuth2/EveOnline.hs b/src/Yesod/Auth/OAuth2/EveOnline.hs
--- a/src/Yesod/Auth/OAuth2/EveOnline.hs
+++ b/src/Yesod/Auth/OAuth2/EveOnline.hs
@@ -11,7 +11,8 @@
     ( oauth2Eve
     , oauth2EveScoped
     , WidgetType(..)
-    ) where
+    )
+where
 
 import Yesod.Auth.OAuth2.Prelude
 
@@ -21,8 +22,7 @@
 newtype User = User Text
 
 instance FromJSON User where
-    parseJSON = withObject "User" $ \o -> User
-        <$> o .: "CharacterOwnerHash"
+    parseJSON = withObject "User" $ \o -> User <$> o .: "CharacterOwnerHash"
 
 data WidgetType m
     = Plain -- ^ Simple "Login via eveonline" text
@@ -34,10 +34,14 @@
 
 asWidget :: YesodAuth m => WidgetType m -> WidgetFor m ()
 asWidget Plain = [whamlet|Login via eveonline|]
-asWidget BigWhite = [whamlet|<img src="https://images.contentful.com/idjq7aai9ylm/4PTzeiAshqiM8osU2giO0Y/5cc4cb60bac52422da2e45db87b6819c/EVE_SSO_Login_Buttons_Large_White.png?w=270&h=45">|]
-asWidget BigBlack = [whamlet|<img src="https://images.contentful.com/idjq7aai9ylm/4fSjj56uD6CYwYyus4KmES/4f6385c91e6de56274d99496e6adebab/EVE_SSO_Login_Buttons_Large_Black.png?w=270&h=45">|]
-asWidget SmallWhite = [whamlet|<img src="https://images.contentful.com/idjq7aai9ylm/18BxKSXCymyqY4QKo8KwKe/c2bdded6118472dd587c8107f24104d7/EVE_SSO_Login_Buttons_Small_White.png?w=195&h=30">|]
-asWidget SmallBlack = [whamlet|<img src="https://images.contentful.com/idjq7aai9ylm/12vrPsIMBQi28QwCGOAqGk/33234da7672c6b0cdca394fc8e0b1c2b/EVE_SSO_Login_Buttons_Small_Black.png?w=195&h=30">|]
+asWidget BigWhite =
+    [whamlet|<img src="https://images.contentful.com/idjq7aai9ylm/4PTzeiAshqiM8osU2giO0Y/5cc4cb60bac52422da2e45db87b6819c/EVE_SSO_Login_Buttons_Large_White.png?w=270&h=45">|]
+asWidget BigBlack
+    = [whamlet|<img src="https://images.contentful.com/idjq7aai9ylm/4fSjj56uD6CYwYyus4KmES/4f6385c91e6de56274d99496e6adebab/EVE_SSO_Login_Buttons_Large_Black.png?w=270&h=45">|]
+asWidget SmallWhite
+    = [whamlet|<img src="https://images.contentful.com/idjq7aai9ylm/18BxKSXCymyqY4QKo8KwKe/c2bdded6118472dd587c8107f24104d7/EVE_SSO_Login_Buttons_Small_White.png?w=195&h=30">|]
+asWidget SmallBlack
+    = [whamlet|<img src="https://images.contentful.com/idjq7aai9ylm/12vrPsIMBQi28QwCGOAqGk/33234da7672c6b0cdca394fc8e0b1c2b/EVE_SSO_Login_Buttons_Small_Black.png?w=195&h=30">|]
 asWidget (Custom a) = a
 
 pluginName :: Text
@@ -49,26 +53,30 @@
 oauth2Eve :: YesodAuth m => WidgetType m -> Text -> Text -> AuthPlugin m
 oauth2Eve = oauth2EveScoped defaultScopes
 
-oauth2EveScoped :: YesodAuth m => [Text] -> WidgetType m -> Text -> Text -> AuthPlugin m
+oauth2EveScoped
+    :: YesodAuth m => [Text] -> WidgetType m -> Text -> Text -> AuthPlugin m
 oauth2EveScoped scopes widgetType clientId clientSecret =
-    authOAuth2Widget (asWidget widgetType) pluginName oauth2 $ \manager token -> do
-        (User userId, userResponse) <-
-            authGetProfile pluginName manager token "https://login.eveonline.com/oauth/verify"
+    authOAuth2Widget (asWidget widgetType) pluginName oauth2
+        $ \manager token -> do
+              (User userId, userResponse) <- authGetProfile
+                  pluginName
+                  manager
+                  token
+                  "https://login.eveonline.com/oauth/verify"
 
-        pure Creds
-            { credsPlugin = "eveonline"
-            -- FIXME: Preserved bug. See similar comment in Bitbucket provider.
-            , credsIdent = T.pack $ show userId
-            , credsExtra = setExtra token userResponse
-            }
+              pure Creds
+                  { credsPlugin = "eveonline"
+                  -- FIXME: Preserved bug. See similar comment in Bitbucket provider.
+                  , credsIdent = T.pack $ show userId
+                  , credsExtra = setExtra token userResponse
+                  }
   where
     oauth2 = OAuth2
         { oauthClientId = clientId
-        , oauthClientSecret = clientSecret
-        , oauthOAuthorizeEndpoint = "https://login.eveonline.com/oauth/authorize" `withQuery`
-            [ ("response_type", "code")
-            , scopeParam " " scopes
-            ]
+        , oauthClientSecret = Just clientSecret
+        , oauthOAuthorizeEndpoint =
+            "https://login.eveonline.com/oauth/authorize"
+                `withQuery` [("response_type", "code"), scopeParam " " scopes]
         , oauthAccessTokenEndpoint = "https://login.eveonline.com/oauth/token"
         , oauthCallback = Nothing
         }
diff --git a/src/Yesod/Auth/OAuth2/GitHub.hs b/src/Yesod/Auth/OAuth2/GitHub.hs
--- a/src/Yesod/Auth/OAuth2/GitHub.hs
+++ b/src/Yesod/Auth/OAuth2/GitHub.hs
@@ -9,7 +9,8 @@
 module Yesod.Auth.OAuth2.GitHub
     ( oauth2GitHub
     , oauth2GitHubScoped
-    ) where
+    )
+where
 
 import Yesod.Auth.OAuth2.Prelude
 
@@ -18,8 +19,7 @@
 newtype User = User Int
 
 instance FromJSON User where
-    parseJSON = withObject "User" $ \o -> User
-        <$> o .: "id"
+    parseJSON = withObject "User" $ \o -> User <$> o .: "id"
 
 pluginName :: Text
 pluginName = "github"
@@ -33,8 +33,11 @@
 oauth2GitHubScoped :: YesodAuth m => [Text] -> Text -> Text -> AuthPlugin m
 oauth2GitHubScoped scopes clientId clientSecret =
     authOAuth2 pluginName oauth2 $ \manager token -> do
-        (User userId, userResponse) <-
-            authGetProfile pluginName manager token "https://api.github.com/user"
+        (User userId, userResponse) <- authGetProfile
+            pluginName
+            manager
+            token
+            "https://api.github.com/user"
 
         pure Creds
             { credsPlugin = pluginName
@@ -44,10 +47,11 @@
   where
     oauth2 = OAuth2
         { oauthClientId = clientId
-        , oauthClientSecret = clientSecret
-        , oauthOAuthorizeEndpoint = "https://github.com/login/oauth/authorize" `withQuery`
-            [ scopeParam "," scopes
-            ]
-        , oauthAccessTokenEndpoint = "https://github.com/login/oauth/access_token"
+        , oauthClientSecret = Just clientSecret
+        , oauthOAuthorizeEndpoint =
+            "https://github.com/login/oauth/authorize"
+                `withQuery` [scopeParam "," scopes]
+        , oauthAccessTokenEndpoint =
+            "https://github.com/login/oauth/access_token"
         , oauthCallback = Nothing
         }
diff --git a/src/Yesod/Auth/OAuth2/GitLab.hs b/src/Yesod/Auth/OAuth2/GitLab.hs
--- a/src/Yesod/Auth/OAuth2/GitLab.hs
+++ b/src/Yesod/Auth/OAuth2/GitLab.hs
@@ -4,7 +4,8 @@
     , oauth2GitLabHostScopes
     , defaultHost
     , defaultScopes
-    ) where
+    )
+where
 
 import Yesod.Auth.OAuth2.Prelude
 
@@ -13,8 +14,7 @@
 newtype User = User Int
 
 instance FromJSON User where
-    parseJSON = withObject "User" $ \o -> User
-        <$> o .: "id"
+    parseJSON = withObject "User" $ \o -> User <$> o .: "id"
 
 pluginName :: Text
 pluginName = "gitlab"
@@ -37,11 +37,14 @@
 oauth2GitLab :: YesodAuth m => Text -> Text -> AuthPlugin m
 oauth2GitLab = oauth2GitLabHostScopes defaultHost defaultScopes
 
-oauth2GitLabHostScopes :: YesodAuth m => URI -> [Text] -> Text -> Text -> AuthPlugin m
+oauth2GitLabHostScopes
+    :: YesodAuth m => URI -> [Text] -> Text -> Text -> AuthPlugin m
 oauth2GitLabHostScopes host scopes clientId clientSecret =
     authOAuth2 pluginName oauth2 $ \manager token -> do
-        (User userId, userResponse) <- authGetProfile pluginName manager token
-            $ host `withPath` "/api/v4/user"
+        (User userId, userResponse) <-
+            authGetProfile pluginName manager token
+            $ host
+            `withPath` "/api/v4/user"
 
         pure Creds
             { credsPlugin = pluginName
@@ -51,10 +54,11 @@
   where
     oauth2 = OAuth2
         { oauthClientId = clientId
-        , oauthClientSecret = clientSecret
-        , oauthOAuthorizeEndpoint = host
+        , oauthClientSecret = Just clientSecret
+        , oauthOAuthorizeEndpoint =
+            host
             `withPath` "/oauth/authorize"
-            `withQuery` [ scopeParam " " scopes ]
+            `withQuery` [scopeParam " " scopes]
         , oauthAccessTokenEndpoint = host `withPath` "/oauth/token"
         , oauthCallback = Nothing
         }
diff --git a/src/Yesod/Auth/OAuth2/Google.hs b/src/Yesod/Auth/OAuth2/Google.hs
--- a/src/Yesod/Auth/OAuth2/Google.hs
+++ b/src/Yesod/Auth/OAuth2/Google.hs
@@ -26,16 +26,18 @@
 module Yesod.Auth.OAuth2.Google
     ( oauth2Google
     , oauth2GoogleScoped
-    ) where
+    )
+where
 
 import Yesod.Auth.OAuth2.Prelude
 
 newtype User = User Text
 
 instance FromJSON User where
-    parseJSON = withObject "User" $ \o -> User
+    parseJSON =
+        withObject "User" $ \o -> User
         -- Required for data backwards-compatibility
-        <$> (("google-uid:" <>) <$> o .: "sub")
+                                       <$> (("google-uid:" <>) <$> o .: "sub")
 
 pluginName :: Text
 pluginName = "google"
@@ -49,8 +51,11 @@
 oauth2GoogleScoped :: YesodAuth m => [Text] -> Text -> Text -> AuthPlugin m
 oauth2GoogleScoped scopes clientId clientSecret =
     authOAuth2 pluginName oauth2 $ \manager token -> do
-        (User userId, userResponse) <-
-            authGetProfile pluginName manager token "https://www.googleapis.com/oauth2/v3/userinfo"
+        (User userId, userResponse) <- authGetProfile
+            pluginName
+            manager
+            token
+            "https://www.googleapis.com/oauth2/v3/userinfo"
 
         pure Creds
             { credsPlugin = pluginName
@@ -60,10 +65,11 @@
   where
     oauth2 = OAuth2
         { oauthClientId = clientId
-        , oauthClientSecret = clientSecret
-        , oauthOAuthorizeEndpoint = "https://accounts.google.com/o/oauth2/auth" `withQuery`
-            [ scopeParam " " scopes
-            ]
-        , oauthAccessTokenEndpoint = "https://www.googleapis.com/oauth2/v3/token"
+        , oauthClientSecret = Just clientSecret
+        , oauthOAuthorizeEndpoint =
+            "https://accounts.google.com/o/oauth2/auth"
+                `withQuery` [scopeParam " " scopes]
+        , oauthAccessTokenEndpoint =
+            "https://www.googleapis.com/oauth2/v3/token"
         , oauthCallback = Nothing
         }
diff --git a/src/Yesod/Auth/OAuth2/Nylas.hs b/src/Yesod/Auth/OAuth2/Nylas.hs
--- a/src/Yesod/Auth/OAuth2/Nylas.hs
+++ b/src/Yesod/Auth/OAuth2/Nylas.hs
@@ -2,7 +2,8 @@
 
 module Yesod.Auth.OAuth2.Nylas
     ( oauth2Nylas
-    ) where
+    )
+where
 
 import Yesod.Auth.OAuth2.Prelude
 
@@ -15,8 +16,7 @@
 newtype User = User Text
 
 instance FromJSON User where
-    parseJSON = withObject "User" $ \o -> User
-        <$> o .: "id"
+    parseJSON = withObject "User" $ \o -> User <$> o .: "id"
 
 pluginName :: Text
 pluginName = "nylas"
@@ -52,17 +52,18 @@
   where
     oauth = OAuth2
         { oauthClientId = clientId
-        , oauthClientSecret = clientSecret
-        , oauthOAuthorizeEndpoint = "https://api.nylas.com/oauth/authorize"
-            `withQuery` [ ("response_type", "code")
-                        , ( "client_id"
-                          , encodeUtf8 clientId
-                          )
+        , oauthClientSecret = Just clientSecret
+        , oauthOAuthorizeEndpoint =
+            "https://api.nylas.com/oauth/authorize"
+                `withQuery` [ ("response_type", "code")
+                            , ( "client_id"
+                              , encodeUtf8 clientId
+                              )
             -- N.B. The scopes delimeter is unknown/untested. Verify that before
             -- extracting this to an argument and offering a Scoped function. In
             -- its current state, it doesn't matter because it's only one scope.
-                        , scopeParam "," defaultScopes
-                        ]
+                            , scopeParam "," defaultScopes
+                            ]
         , oauthAccessTokenEndpoint = "https://api.nylas.com/oauth/token"
         , oauthCallback = Nothing
         }
diff --git a/src/Yesod/Auth/OAuth2/Prelude.hs b/src/Yesod/Auth/OAuth2/Prelude.hs
--- a/src/Yesod/Auth/OAuth2/Prelude.hs
+++ b/src/Yesod/Auth/OAuth2/Prelude.hs
@@ -91,11 +91,10 @@
     pure (decoded, resp)
 
 -- | Throws a @Left@ result as an @'YesodOAuth2Exception'@
-fromAuthGet
-    :: Text -> Either (OAuth2Error Value) BL.ByteString -> IO BL.ByteString
+fromAuthGet :: Text -> Either BL.ByteString BL.ByteString -> IO BL.ByteString
 fromAuthGet _ (Right bs) = pure bs -- nice
 fromAuthGet name (Left err) =
-    throwIO $ YesodOAuth2Exception.OAuth2Error name $ encode err
+    throwIO $ YesodOAuth2Exception.OAuth2Error name err
 
 -- | Throws a decoding error as an @'YesodOAuth2Exception'@
 fromAuthJSON :: FromJSON a => Text -> BL.ByteString -> IO a
diff --git a/src/Yesod/Auth/OAuth2/Salesforce.hs b/src/Yesod/Auth/OAuth2/Salesforce.hs
--- a/src/Yesod/Auth/OAuth2/Salesforce.hs
+++ b/src/Yesod/Auth/OAuth2/Salesforce.hs
@@ -11,15 +11,15 @@
     , oauth2SalesforceScoped
     , oauth2SalesforceSandbox
     , oauth2SalesforceSandboxScoped
-    ) where
+    )
+where
 
 import Yesod.Auth.OAuth2.Prelude
 
 newtype User = User Text
 
 instance FromJSON User where
-    parseJSON = withObject "User" $ \o -> User
-        <$> o .: "user_id"
+    parseJSON = withObject "User" $ \o -> User <$> o .: "user_id"
 
 pluginName :: Text
 pluginName = "salesforce"
@@ -31,7 +31,8 @@
 oauth2Salesforce = oauth2SalesforceScoped defaultScopes
 
 oauth2SalesforceScoped :: YesodAuth m => [Text] -> Text -> Text -> AuthPlugin m
-oauth2SalesforceScoped = salesforceHelper pluginName
+oauth2SalesforceScoped = salesforceHelper
+    pluginName
     "https://login.salesforce.com/services/oauth2/userinfo"
     "https://login.salesforce.com/services/oauth2/authorize"
     "https://login.salesforce.com/services/oauth2/token"
@@ -39,8 +40,10 @@
 oauth2SalesforceSandbox :: YesodAuth m => Text -> Text -> AuthPlugin m
 oauth2SalesforceSandbox = oauth2SalesforceSandboxScoped defaultScopes
 
-oauth2SalesforceSandboxScoped :: YesodAuth m => [Text] -> Text -> Text -> AuthPlugin m
-oauth2SalesforceSandboxScoped = salesforceHelper (pluginName <> "-sandbox")
+oauth2SalesforceSandboxScoped
+    :: YesodAuth m => [Text] -> Text -> Text -> AuthPlugin m
+oauth2SalesforceSandboxScoped = salesforceHelper
+    (pluginName <> "-sandbox")
     "https://test.salesforce.com/services/oauth2/userinfo"
     "https://test.salesforce.com/services/oauth2/authorize"
     "https://test.salesforce.com/services/oauth2/token"
@@ -55,9 +58,13 @@
     -> Text
     -> Text
     -> AuthPlugin m
-salesforceHelper name profileUri authorizeUri tokenUri scopes clientId clientSecret =
-    authOAuth2 name oauth2 $ \manager token -> do
-        (User userId, userResponse) <- authGetProfile name manager token profileUri
+salesforceHelper name profileUri authorizeUri tokenUri scopes clientId clientSecret
+    = authOAuth2 name oauth2 $ \manager token -> do
+        (User userId, userResponse) <- authGetProfile
+            name
+            manager
+            token
+            profileUri
 
         pure Creds
             { credsPlugin = pluginName
@@ -67,8 +74,9 @@
   where
     oauth2 = OAuth2
         { oauthClientId = clientId
-        , oauthClientSecret = clientSecret
-        , oauthOAuthorizeEndpoint = authorizeUri `withQuery` [scopeParam " " scopes]
+        , oauthClientSecret = Just clientSecret
+        , oauthOAuthorizeEndpoint =
+            authorizeUri `withQuery` [scopeParam " " scopes]
         , oauthAccessTokenEndpoint = tokenUri
         , oauthCallback = Nothing
         }
diff --git a/src/Yesod/Auth/OAuth2/Slack.hs b/src/Yesod/Auth/OAuth2/Slack.hs
--- a/src/Yesod/Auth/OAuth2/Slack.hs
+++ b/src/Yesod/Auth/OAuth2/Slack.hs
@@ -9,7 +9,8 @@
     ( SlackScope(..)
     , oauth2Slack
     , oauth2SlackScoped
-    ) where
+    )
+where
 
 import Yesod.Auth.OAuth2.Prelude
 
@@ -65,9 +66,10 @@
   where
     oauth2 = OAuth2
         { oauthClientId = clientId
-        , oauthClientSecret = clientSecret
-        , oauthOAuthorizeEndpoint = "https://slack.com/oauth/authorize"
-            `withQuery` [scopeParam "," $ map scopeText scopes]
+        , oauthClientSecret = Just clientSecret
+        , oauthOAuthorizeEndpoint =
+            "https://slack.com/oauth/authorize"
+                `withQuery` [scopeParam "," $ map scopeText scopes]
         , oauthAccessTokenEndpoint = "https://slack.com/api/oauth.access"
         , oauthCallback = Nothing
         }
diff --git a/src/Yesod/Auth/OAuth2/Spotify.hs b/src/Yesod/Auth/OAuth2/Spotify.hs
--- a/src/Yesod/Auth/OAuth2/Spotify.hs
+++ b/src/Yesod/Auth/OAuth2/Spotify.hs
@@ -5,15 +5,15 @@
 --
 module Yesod.Auth.OAuth2.Spotify
     ( oauth2Spotify
-    ) where
+    )
+where
 
 import Yesod.Auth.OAuth2.Prelude
 
 newtype User = User Text
 
 instance FromJSON User where
-    parseJSON = withObject "User" $ \o -> User
-        <$> o .: "id"
+    parseJSON = withObject "User" $ \o -> User <$> o .: "id"
 
 pluginName :: Text
 pluginName = "spotify"
@@ -21,8 +21,11 @@
 oauth2Spotify :: YesodAuth m => [Text] -> Text -> Text -> AuthPlugin m
 oauth2Spotify scopes clientId clientSecret =
     authOAuth2 pluginName oauth2 $ \manager token -> do
-        (User userId, userResponse) <-
-            authGetProfile pluginName manager token "https://api.spotify.com/v1/me"
+        (User userId, userResponse) <- authGetProfile
+            pluginName
+            manager
+            token
+            "https://api.spotify.com/v1/me"
 
         pure Creds
             { credsPlugin = pluginName
@@ -32,10 +35,10 @@
   where
     oauth2 = OAuth2
         { oauthClientId = clientId
-        , oauthClientSecret = clientSecret
-        , oauthOAuthorizeEndpoint = "https://accounts.spotify.com/authorize" `withQuery`
-            [ scopeParam " " scopes
-            ]
+        , oauthClientSecret = Just clientSecret
+        , oauthOAuthorizeEndpoint =
+            "https://accounts.spotify.com/authorize"
+                `withQuery` [scopeParam " " scopes]
         , oauthAccessTokenEndpoint = "https://accounts.spotify.com/api/token"
         , oauthCallback = Nothing
         }
diff --git a/src/Yesod/Auth/OAuth2/Upcase.hs b/src/Yesod/Auth/OAuth2/Upcase.hs
--- a/src/Yesod/Auth/OAuth2/Upcase.hs
+++ b/src/Yesod/Auth/OAuth2/Upcase.hs
@@ -8,7 +8,8 @@
 --
 module Yesod.Auth.OAuth2.Upcase
     ( oauth2Upcase
-    ) where
+    )
+where
 
 import Yesod.Auth.OAuth2.Prelude
 
@@ -27,8 +28,11 @@
 oauth2Upcase :: YesodAuth m => Text -> Text -> AuthPlugin m
 oauth2Upcase clientId clientSecret =
     authOAuth2 pluginName oauth2 $ \manager token -> do
-        (User userId, userResponse) <-
-            authGetProfile pluginName manager token "http://upcase.com/api/v1/me.json"
+        (User userId, userResponse) <- authGetProfile
+            pluginName
+            manager
+            token
+            "http://upcase.com/api/v1/me.json"
 
         pure Creds
             { credsPlugin = pluginName
@@ -38,7 +42,7 @@
   where
     oauth2 = OAuth2
         { oauthClientId = clientId
-        , oauthClientSecret = clientSecret
+        , oauthClientSecret = Just clientSecret
         , oauthOAuthorizeEndpoint = "http://upcase.com/oauth/authorize"
         , oauthAccessTokenEndpoint = "http://upcase.com/oauth/token"
         , oauthCallback = Nothing
diff --git a/src/Yesod/Auth/OAuth2/WordPressDotCom.hs b/src/Yesod/Auth/OAuth2/WordPressDotCom.hs
--- a/src/Yesod/Auth/OAuth2/WordPressDotCom.hs
+++ b/src/Yesod/Auth/OAuth2/WordPressDotCom.hs
@@ -38,7 +38,7 @@
   where
     oauth2 = OAuth2
         { oauthClientId = clientId
-        , oauthClientSecret = clientSecret
+        , oauthClientSecret = Just clientSecret
         , oauthOAuthorizeEndpoint =
             "https://public-api.wordpress.com/oauth2/authorize"
                 `withQuery` [scopeParam "," ["auth"]]
diff --git a/yesod-auth-oauth2.cabal b/yesod-auth-oauth2.cabal
--- a/yesod-auth-oauth2.cabal
+++ b/yesod-auth-oauth2.cabal
@@ -4,10 +4,10 @@
 --
 -- see: https://github.com/sol/hpack
 --
--- hash: e7ae534f10b6ab3a73cef745b8a57142ae8fb00183d08eaf18d7a5d340ccf2bf
+-- hash: 3e66a5211c9fd4ac4c5addba52631217bcef9d304e428821d6f77d7e10dc648e
 
 name:           yesod-auth-oauth2
-version:        0.6.1.4
+version:        0.6.1.5
 synopsis:       OAuth 2.0 authentication plugins
 description:    Library to authenticate with OAuth 2.0 for Yesod web applications.
 category:       Web
@@ -63,7 +63,7 @@
     , bytestring >=0.9.1.4
     , cryptonite
     , errors
-    , hoauth2 >=1.7.0 && <1.9
+    , hoauth2 >=1.11.0 && <1.15
     , http-client >=0.4.0 && <0.7
     , http-conduit >=2.0 && <3.0
     , http-types >=0.8 && <0.13