auth-foundation/com.okta.authfoundation.client/ClientAssertionProvider

ClientAssertionProvider

Provides a fresh ClientAssertion for each OAuth2 request that needs client authentication (token endpoint requests and Pushed Authorization Requests).

clientAssertionProvider = ClientAssertionProvider { audience ->
    ClientAssertion(
        type = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer",
        assertion = signJwt(issuer = clientId, subject = clientId, audience = audience)
    )
}

Functions

provide

abstract fun provide(audience: String): ClientAssertion

Invoked anew for every request that needs client authentication — never cached or reused by the SDK — so the returned assertion can carry a unique jti and a correctly scoped, non-expired exp/aud. See Okta's client authentication guide for the exact claim requirements (e.g. exp must not be more than one hour out, and a jti may only be used once).