Class PrivateKeyJwtProvider

constructor

• new PrivateKeyJwtProvider(
      options: PrivateKeyJwtProviderOptions,
  ): PrivateKeyJwtProvider

  Parameters

  • options: PrivateKeyJwtProviderOptions

  Returns PrivateKeyJwtProvider

addClientAuthentication

clientMetadata

• get clientMetadata(): {
      client_name?: string;
      client_uri?: string;
      contacts?: string[];
      grant_types?: string[];
      jwks?: any;
      jwks_uri?: string;
      logo_uri?: string;
      policy_uri?: string;
      redirect_uris: string[];
      response_types?: string[];
      scope?: string;
      software_id?: string;
      software_statement?: string;
      software_version?: string;
      token_endpoint_auth_method?: string;
      tos_uri?: string;
  }

  Metadata about this OAuth client.

  Returns {
      client_name?: string;
      client_uri?: string;
      contacts?: string[];
      grant_types?: string[];
      jwks?: any;
      jwks_uri?: string;
      logo_uri?: string;
      policy_uri?: string;
      redirect_uris: string[];
      response_types?: string[];
      scope?: string;
      software_id?: string;
      software_statement?: string;
      software_version?: string;
      token_endpoint_auth_method?: string;
      tos_uri?: string;
  }

redirectUrl

• get redirectUrl(): undefined

  The URL to redirect the user agent to after authorization. Return undefined for non-interactive flows that don't require user interaction (e.g., client_credentials, jwt-bearer).

  Returns undefined

clientInformation

• clientInformation(): {
      client_id: string;
      client_id_issued_at?: number;
      client_secret?: string;
      client_secret_expires_at?: number;
  }

  Loads information about this OAuth client, as registered already with the server, or returns undefined if the client is not registered with the server.

  Returns {
      client_id: string;
      client_id_issued_at?: number;
      client_secret?: string;
      client_secret_expires_at?: number;
  }

codeVerifier

• codeVerifier(): string

  Loads the PKCE code verifier for the current session, necessary to validate the authorization result.

  Returns string

prepareTokenRequest

• prepareTokenRequest(scope?: string): URLSearchParams

  Prepares grant-specific parameters for a token request.

  This optional method allows providers to customize the token request based on the grant type they support. When implemented, it returns the grant type and any grant-specific parameters needed for the token exchange.

  If not implemented, the default behavior depends on the flow:

  • For authorization code flow: uses code, code_verifier, and redirect_uri
  • For client_credentials: detected via grant_types in clientMetadata

  Parameters

  • Optionalscope: string

    Optional scope to request

  Returns URLSearchParams

  Grant type and parameters, or undefined to use default behavior

  Example

  // For client_credentials grant:
  prepareTokenRequest(scope) {
    return {
      grantType: 'client_credentials',
      params: scope ? { scope } : {}
    };
  }
  Copy

  Example

  // For authorization_code grant (default behavior):
  async prepareTokenRequest() {
    return {
      grantType: 'authorization_code',
      params: {
        code: this.authorizationCode,
        code_verifier: await this.codeVerifier(),
        redirect_uri: String(this.redirectUrl)
      }
    };
  }
  Copy

redirectToAuthorization

• redirectToAuthorization(): void

  Invoked to redirect the user agent to the given URL to begin the authorization flow.

  Returns void

saveClientInformation

• saveClientInformation(
      info: {
          client_id: string;
          client_id_issued_at?: number;
          client_secret?: string;
          client_secret_expires_at?: number;
      },
  ): void

  If implemented, this permits the OAuth client to dynamically register with the server. Client information saved this way should later be read via clientInformation().

  This method is not required to be implemented if client information is statically known (e.g., pre-registered).

  Parameters

  • info: {
        client_id: string;
        client_id_issued_at?: number;
        client_secret?: string;
        client_secret_expires_at?: number;
    }

  Returns void

saveCodeVerifier

• saveCodeVerifier(): void

  Saves a PKCE code verifier for the current session, before redirecting to the authorization flow.

  Returns void

saveTokens

• saveTokens(
      tokens: {
          access_token: string;
          expires_in?: number;
          id_token?: string;
          refresh_token?: string;
          scope?: string;
          token_type: string;
      },
  ): void

  Stores new OAuth tokens for the current session, after a successful authorization.

  Parameters

  • tokens: {
        access_token: string;
        expires_in?: number;
        id_token?: string;
        refresh_token?: string;
        scope?: string;
        token_type: string;
    }

  Returns void

tokens

• tokens(): | {
      access_token: string;
      expires_in?: number;
      id_token?: string;
      refresh_token?: string;
      scope?: string;
      token_type: string;
  }
  | undefined

  Loads any existing OAuth tokens for the current session, or returns undefined if there are no saved tokens.

  Returns
      | {
          access_token: string;
          expires_in?: number;
          id_token?: string;
          refresh_token?: string;
          scope?: string;
          token_type: string;
      }
      | undefined