Skip to main content
Defined in: client/auth.ts:544 private_key_jwt configuration for ClientCredentials (RFC 7523 / SEP-1046): the client proves its identity with a signed JWT client_assertion instead of a shared secret. The assertion is signed by the SDK’s own private_key_jwt machinery — no secret is ever sent to the token endpoint.

​
Extends

  • ClientCredentialsBaseOptions

​
Properties

​
algorithm

Defined in: client/auth.ts:548 JWS signing algorithm, e.g. ES256 or RS256.

​
audience

Defined in: client/auth.ts:556 The assertion’s aud claim. Required — there is no safe default, because this provider does no discovery and cannot learn the authorization server’s identity on its own. RFC 7523 §3 recommends the authorization server’s issuer identifier; some servers instead verify against the token endpoint URL. Set whichever your server checks (issuer is the more common choice).

​
authMethod?

Defined in: client/auth.ts:562

​
claims?

Defined in: client/auth.ts:560 Extra claims merged over the standard iss/sub/aud/exp/iat/jti.

​
clientId

Defined in: client/auth.ts:506

​
Inherited from

​
clientSecret?

Defined in: client/auth.ts:561

​
jwtLifetimeSeconds?

Defined in: client/auth.ts:558 Assertion lifetime in seconds. Default: 300.

​
privateKey

Defined in: client/auth.ts:546 Signing key: a PEM (PKCS#8) string, its bytes, or a JWK object.

​
refreshBufferSeconds?

Defined in: client/auth.ts:518 How many seconds before expiry to proactively re-fetch. Default: 60.

​
Inherited from

​
scope?

Defined in: client/auth.ts:507

​
Inherited from

​
store?

Defined in: client/auth.ts:516 Persistent token store. Default: in-memory. The cache key is derived from tokenEndpoint alone, with no client identity in it — use one store per credential identity. Do not share a persistent store across two ClientCredentials instances that have different clientId/clientSecret/ privateKey but the same tokenEndpoint; they will read and overwrite each other’s cached tokens.

​
Inherited from

​
tokenEndpoint

Defined in: client/auth.ts:505

​
Inherited from