Module client_assertion 

Client-side minting of private_key_jwt client assertions (RFC 7523 §2.2, OIDC Core §9).

This is the mirror image of authkestra_op::client_assertion, which verifies an inbound assertion at the OP — that module cannot live here (it needs ClientRegistration/replay-store types this crate has no business knowing about), but this crate is the one place both halves can share without a dependency cycle: authkestra-op already depends on authkestra-engine, never the other way around. So the two constants below are defined exactly once, here, and authkestra-op re-exports them rather than keeping its own copies — the assertion-type URN and the maximum assertion lifetime literally cannot drift between the client side (crate::flow::ClientCredentialsFlow::new_private_key_jwt) and this workspace’s own OP.

See mint_client_assertion for the minting logic itself.

Constants

CLIENT_ASSERTION_TYPE_JWT_BEARER

The client_assertion_type value RFC 7523 §2.2 requires when presenting a private_key_jwt assertion at a token endpoint.

MAX_CLIENT_ASSERTION_LIFETIME_SECS

Upper bound on how far in the future a minted assertion’s exp may sit.

Functions

mint_client_assertion

Mints a fresh private_key_jwt client assertion authenticating client_id to audience (the token endpoint URL, per RFC 7523 §3).