Validated token-endpoint response.
The struct carries protocol output and optional local DPoP key provenance. The application decides whether, where, and for how long to retain tokens. In particular, this library never creates a login session or makes an authorization decision from token claims.
The optional :refresh_token_timeout and :authorization_expires_in
durations follow draft-ietf-oauth-refresh-token-expiration-03. They are
literal seconds from the response time; absence is not proof that the
server implements the draft or that a credential cannot expire early.
:dpop_jkt is the public-key thumbprint derived locally when a DPoP token
response is accepted. It never comes from token-endpoint JSON. Persist it
with the tokens and retain the corresponding private key for refresh. Older
token sets may omit it; their original key cannot be verified retrospectively.
Profile flows also retain :profile, :client_auth_binding, :client_id
and :issuer locally. Persist these fields for authenticated refresh and
pass the complete token set to HAIP credential issuance. They never come
from server JSON, and the authentication binding contains no private key.
:id_token_alg retains the locally selected ID Token verification algorithm
from authorization or refresh. Persist it with the token set so refresh uses
the same policy. It never comes from token-endpoint JSON.
Summary
Types
@type t() :: %AttestoClient.TokenSet{ access_token: String.t(), authorization_expires_in: non_neg_integer() | nil, client_auth_binding: map() | nil, client_id: String.t() | nil, dpop_jkt: String.t() | nil, expires_in: non_neg_integer() | nil, extra: map(), id_token: String.t() | nil, id_token_alg: String.t() | nil, issuer: String.t() | nil, profile: :generic | :haip | :fapi, refresh_token: String.t() | nil, refresh_token_timeout: non_neg_integer() | nil, scope: String.t() | nil, token_type: String.t() }