Latch.ClientAssertion (latch v0.4.0)

Copy Markdown

Client assertion JWTs (RFC 7523 private_key_jwt) for atproto OAuth.

Confidential clients authenticate to the authorization server by signing a fresh assertion for every PAR and token request.

Summary

Functions

assertion_type()

The client_assertion_type request parameter value.

kid(key_map)

Key ID for the client signing key: the JWK's own kid if set, otherwise its RFC 7638 thumbprint.

sign(key_map, client_id, audience, opts \\ [])

Signs a client assertion JWT.

Functions

assertion_type()

@spec assertion_type() :: String.t()

The client_assertion_type request parameter value.

kid(key_map)

@spec kid(map()) :: String.t()

Key ID for the client signing key: the JWK's own kid if set, otherwise its RFC 7638 thumbprint.

The published client metadata JWKs must use the same value so the authorization server can match assertion headers to a key.

sign(key_map, client_id, audience, opts \\ [])

@spec sign(map(), String.t(), String.t(), keyword()) :: String.t()

Signs a client assertion JWT.

Arguments

  • jwk - the client's private plain JWK map
  • client_id - used as both iss and sub
  • audience - the authorization server's issuer URL

Options

  • :jti - override jti (tests)
  • :iat - override iat (tests)

exp is iat + 60s: atproto does not require it, but RFC 7523 does, and servers expect assertions younger than a minute.