Skip to main content
Defined in: client/auth.ts:758 Configuration for JwtBearerAuth. The client presents a pre-issued, signed JWT (assertion) directly to the token endpoint under grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer (RFC 7523 §2.1). No interactive authorization, no client secret by default — this is the workload-identity-federation shape (SEP-1933): a workload proves its identity with a JWT its runtime already minted (a Kubernetes projected service-account token, a cloud instance-identity JWT, etc.).

​
Properties

​
assertion

Defined in: client/auth.ts:766 The workload assertion (a signed JWT). Pass a string for a fixed assertion, or a callback to mint/read a fresh one each time a token is fetched (the usual case — workload JWTs are short-lived).

​
authMethod?

Defined in: client/auth.ts:773 Token-endpoint client authentication. Default: none (public client — the assertion itself is the credential, so no separate client secret is sent).

​
clientId?

Defined in: client/auth.ts:768 The client identifier registered for this workload.

​
clientSecret?

Defined in: client/auth.ts:775 Client secret, when authMethod is client_secret_basic/_post.

​
refreshBufferSeconds?

Defined in: client/auth.ts:788 How many seconds before expiry to proactively re-fetch. Default: 60.

​
scope?

Defined in: client/auth.ts:777 Requested scopes (space-separated).

​
store?

Defined in: client/auth.ts:786 Persistent token store. Default: in-memory. The cache key is derived from tokenEndpoint alone, with no client identity in it — use one store per credential identity. Do not share a persistent store across two JwtBearerAuth instances that have different clientId/assertion but the same tokenEndpoint; they will read and overwrite each other’s cached tokens.

​
tokenEndpoint

Defined in: client/auth.ts:760 The authorization server’s token endpoint.