> ## Documentation Index
> Fetch the complete documentation index at: https://fastmcp-ts.docs.prefect.io/llms.txt
> Use this file to discover all available pages before exploring further.

# PrivateKeyJwtCredentialsOptions

Defined in: [client/auth.ts:544](https://github.com/PrefectHQ/fastmcp-ts/blob/e4b6038f642b529f601463a576229747afebe9a4/src/client/auth.ts#L544)

`private_key_jwt` configuration for [ClientCredentials](/api/client/classes/ClientCredentials) (RFC 7523 /
SEP-1046): the client proves its identity with a signed JWT `client_assertion`
instead of a shared secret. The assertion is signed by the SDK's own
`private_key_jwt` machinery — no secret is ever sent to the token endpoint.

## Extends

* `ClientCredentialsBaseOptions`

## Properties

### algorithm

```ts theme={null}
algorithm: string;
```

Defined in: [client/auth.ts:548](https://github.com/PrefectHQ/fastmcp-ts/blob/e4b6038f642b529f601463a576229747afebe9a4/src/client/auth.ts#L548)

JWS signing algorithm, e.g. `ES256` or `RS256`.

***

### audience

```ts theme={null}
audience: string;
```

Defined in: [client/auth.ts:556](https://github.com/PrefectHQ/fastmcp-ts/blob/e4b6038f642b529f601463a576229747afebe9a4/src/client/auth.ts#L556)

The assertion's `aud` claim. Required — there is no safe default, because
this provider does no discovery and cannot learn the authorization server's
identity on its own. RFC 7523 §3 recommends the authorization server's
`issuer` identifier; some servers instead verify against the token endpoint
URL. Set whichever your server checks (issuer is the more common choice).

***

### authMethod?

```ts theme={null}
optional authMethod?: undefined;
```

Defined in: [client/auth.ts:562](https://github.com/PrefectHQ/fastmcp-ts/blob/e4b6038f642b529f601463a576229747afebe9a4/src/client/auth.ts#L562)

***

### claims?

```ts theme={null}
optional claims?: Record<string, unknown>;
```

Defined in: [client/auth.ts:560](https://github.com/PrefectHQ/fastmcp-ts/blob/e4b6038f642b529f601463a576229747afebe9a4/src/client/auth.ts#L560)

Extra claims merged over the standard `iss`/`sub`/`aud`/`exp`/`iat`/`jti`.

***

### clientId

```ts theme={null}
clientId: string;
```

Defined in: [client/auth.ts:506](https://github.com/PrefectHQ/fastmcp-ts/blob/e4b6038f642b529f601463a576229747afebe9a4/src/client/auth.ts#L506)

#### Inherited from

```ts theme={null}
ClientCredentialsBaseOptions.clientId
```

***

### clientSecret?

```ts theme={null}
optional clientSecret?: undefined;
```

Defined in: [client/auth.ts:561](https://github.com/PrefectHQ/fastmcp-ts/blob/e4b6038f642b529f601463a576229747afebe9a4/src/client/auth.ts#L561)

***

### jwtLifetimeSeconds?

```ts theme={null}
optional jwtLifetimeSeconds?: number;
```

Defined in: [client/auth.ts:558](https://github.com/PrefectHQ/fastmcp-ts/blob/e4b6038f642b529f601463a576229747afebe9a4/src/client/auth.ts#L558)

Assertion lifetime in seconds. Default: 300.

***

### privateKey

```ts theme={null}
privateKey: 
  | string
  | Record<string, unknown>
  | Uint8Array<ArrayBufferLike>;
```

Defined in: [client/auth.ts:546](https://github.com/PrefectHQ/fastmcp-ts/blob/e4b6038f642b529f601463a576229747afebe9a4/src/client/auth.ts#L546)

Signing key: a PEM (PKCS#8) string, its bytes, or a JWK object.

***

### refreshBufferSeconds?

```ts theme={null}
optional refreshBufferSeconds?: number;
```

Defined in: [client/auth.ts:518](https://github.com/PrefectHQ/fastmcp-ts/blob/e4b6038f642b529f601463a576229747afebe9a4/src/client/auth.ts#L518)

How many seconds before expiry to proactively re-fetch. Default: 60.

#### Inherited from

```ts theme={null}
ClientCredentialsBaseOptions.refreshBufferSeconds
```

***

### scope?

```ts theme={null}
optional scope?: string;
```

Defined in: [client/auth.ts:507](https://github.com/PrefectHQ/fastmcp-ts/blob/e4b6038f642b529f601463a576229747afebe9a4/src/client/auth.ts#L507)

#### Inherited from

```ts theme={null}
ClientCredentialsBaseOptions.scope
```

***

### store?

```ts theme={null}
optional store?: KeyValueStore;
```

Defined in: [client/auth.ts:516](https://github.com/PrefectHQ/fastmcp-ts/blob/e4b6038f642b529f601463a576229747afebe9a4/src/client/auth.ts#L516)

Persistent token store. Default: in-memory. The cache key is derived from
`tokenEndpoint` alone, with no client identity in it — use one store per
credential identity. Do not share a persistent `store` across two
`ClientCredentials` instances that have different `clientId`/`clientSecret`/
`privateKey` but the same `tokenEndpoint`; they will read and overwrite
each other's cached tokens.

#### Inherited from

```ts theme={null}
ClientCredentialsBaseOptions.store
```

***

### tokenEndpoint

```ts theme={null}
tokenEndpoint: string;
```

Defined in: [client/auth.ts:505](https://github.com/PrefectHQ/fastmcp-ts/blob/e4b6038f642b529f601463a576229747afebe9a4/src/client/auth.ts#L505)

#### Inherited from

```ts theme={null}
ClientCredentialsBaseOptions.tokenEndpoint
```