Skip to main content

mint_client_assertion

authkestra_engine::client_assertion

Function mint_client_assertion 

Source 
pub fn mint_client_assertion(
    client_id: &str,
    audience: &str,
    encoding_key: &EncodingKey,
    alg: Algorithm,
    kid: Option<&str>,
    lifetime_secs: i64,
) -> Result<String, AuthError>
Expand description

Mints a fresh private_key_jwt client assertion authenticating client_id to audience (the token endpoint URL, per RFC 7523 §3).

A fresh jti (UUIDv4) is generated on every call: reusing one across calls would hand a replay-tracking verifier — such as authkestra_op::client_assertion::ClientAssertionStore — a second presentation of an id it already spent, which is indistinguishable from an actual replay and would be rejected.

lifetime_secs is clamped to 1..=MAX_CLIENT_ASSERTION_LIFETIME_SECS rather than trusted verbatim: a caller-supplied value above that ceiling would only mint an assertion this workspace’s own OP (or any verifier enforcing the same bound) refuses, for a reason invisible from here: it’s cheaper to clamp than to hand back an assertion doomed to fail verification for a reason invisible at the call site.