Struct ClientCredentialsFlow 

#[non_exhaustive]
pub struct ClientCredentialsFlow { /* private fields */ }

Orchestrates the Client Credentials Flow (RFC 6749 Section 4.4).

This flow is used by clients to obtain an access token outside of the context of a user. This is typically used for client-to-client communication.

Implementations

impl ClientCredentialsFlow

pub fn new(client_id: String, client_secret: String, token_url: String) -> Self

Creates a new ClientCredentialsFlow instance authenticating with a shared client_secret (RFC 6749 §2.3.1).

Arguments

• client_id - The client ID assigned to the client.
• client_secret - The client secret assigned to the client.
• token_url - The URL of the token endpoint.

pub fn new_private_key_jwt( client_id: String, signing_key: EncodingKey, alg: Algorithm, token_url: String, ) -> Self

Creates a new ClientCredentialsFlow instance authenticating with private_key_jwt (RFC 7523 §2.2) instead of a shared secret.

Use this when the client cannot hold a shared secret at all — e.g. a backend service that only ever authenticates from a keystore holding an asymmetric keypair, with just the public half registered against this client_id at the authorization server. get_token mints a fresh assertion JWT (iss/sub = client_id, aud = token_url, a new jti, and exp bounded by crate::client_assertion::MAX_CLIENT_ASSERTION_LIFETIME_SECS) on every call and sends it as client_assertion alongside client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer, in place of client_secret.

Arguments

• client_id - The client ID assigned to the client.
• signing_key - The private key to sign assertions with. Must match alg (e.g. an Ed25519 key for Algorithm::EdDSA).
• alg - The signature algorithm signing_key signs with. This crate’s own OP (authkestra_op::client_assertion) derives the algorithm it will accept from the client’s registered public key, never from this header, so alg here must agree with whatever key type was registered.
• token_url - The URL of the token endpoint; also the aud claim minted into every assertion.

pub fn with_kid(self, kid: impl Into<String>) -> Self

Stamps kid onto the header of every assertion minted by private_key_jwt authentication, so a server with several keys registered for this client can tell which one signed it (see authkestra_op::client_assertion::select_key).

A no-op when this flow was constructed via Self::new — there is no assertion to stamp a kid onto when authenticating with a shared secret.

pub async fn get_token( &self, scopes: Option<&[&str]>, ) -> Result<OAuthToken, AuthError>

Obtains an access token using the client credentials.

Arguments

• scopes - An optional list of scopes to request.

Returns

A Result containing the OAuthToken if successful, or an AuthError otherwise.