provide

Invoked anew for every request that needs client authentication — never cached or reused by the SDK — so the returned assertion can carry a unique jti and a correctly scoped, non-expired exp/aud. See Okta's client authentication guide for the exact claim requirements (e.g. exp must not be more than one hour out, and a jti may only be used once).

Intentionally not a suspend function so it stays directly implementable from Java as a lambda via OAuth2ClientBuilder.clientAssertionProvider/setClientAssertionProvider. The SDK invokes it on OAuth2ClientConfiguration.computeDispatcher (default kotlinx.coroutines.Dispatchers.Default), so implementations must be non-blocking CPU-bound work only (e.g. an in-memory or hardware-backed signing call). If your implementation performs blocking I/O — a network call to a remote signer, a blocking Keystore/HSM round trip — set computeDispatcher to Dispatchers.IO (or another IO-appropriate dispatcher) when building the client so that work doesn't starve the default dispatcher's limited parallelism.

If this throws, the exception propagates as the Result.failure of the request that triggered it (start/resume/OAuth2ClientConfiguration.clientAuthenticationFormParameters callers) — there is no dedicated exception type distinguishing a signer failure from a network or server failure.

Parameters