OAuth2ClientConfiguration

Validator for access tokens. Validates at_hash claim against the access token hash.

Optional ACR values.

Allows browser-based authorization flows to fall back to the classic authorization request URL when PAR is optional but unavailable or the push request fails.

The HTTP executor used for all network requests.

The authorization server ID provided at build time, or null for the org authorization server.

The cache used to optimize network calls.

Optional provider for private_key_jwt (or similar JWT-based) client authentication. Mutually exclusive with clientSecret. See ClientAssertionProvider.

The application's client ID.

Optional client secret for confidential clients.

The clock used for time-related operations (token expiry, JWT validation).

The dispatcher used for CPU-bound work, such as invoking clientAssertionProvider.

The default access scopes required by the client.

Validator for device secrets. Validates ds_hash claim against the device secret hash.

Enables Pushed Authorization Requests (PAR) for browser-based authorization flows.

Optional per-endpoint URL overrides. Non-null fields win over discovery results.

Validator for ID tokens. ID tokens are validated after token refresh.

The effective issuer URL used for OIDC discovery and token validation.

The JSON serializer for encoding/decoding responses.

Optional callback invoked when an HTTP 429 rate-limit response is received.

Builds the client-authentication form parameters for a request to audience (the exact endpoint URL being called), invoking clientAssertionProvider fresh if configured so its assertion can carry a unique jti and a correctly scoped aud/exp.