clientAssertionProvider

Optional provider for private_key_jwt (or similar JWT-based) client authentication.

Invoked fresh for every token/PAR request — never cached or reused by the SDK — so the returned assertion can carry a unique jti and a correctly scoped aud/exp. Mutually exclusive with clientSecret.

clientAssertionProvider = ClientAssertionProvider { audience ->
    ClientAssertion(
        type = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer",
        assertion = signJwt(issuer = clientId, subject = clientId, audience = audience)
    )
}

See also