IO Wallet SDK
    Preparing search index...

    Function createAccessTokenResponse

    • Creates an OAuth 2.0 access token response where access_token is a signed JWT access token profile (typ=at+jwt) and token_type is DPoP or Bearer.

      The JWT payload always includes aud, iss, sub, client_id, iat, exp, and a random jti. When dpop is provided, cnf.jkt is added using the SHA-256 JWK thumbprint.

      When refreshTokenExpiresInSeconds is provided, a DPoP-bound Refresh Token JWT (typ=rt+jwt) is generated, signed, and returned as refresh_token. Refresh Token issuance requires tokenType to be DPoP with a dpop public key, and results in nbf equal to the Access Token exp and exp later than that.

      Parameters

      Returns Promise<
          {
              access_token: string;
              authorization_details?: {
                  credential_configuration_id?: string;
                  credential_identifiers?: string[];
                  type: "openid_credential";
                  [key: string]: unknown;
              }[];
              expires_in?: number;
              refresh_token?: string;
              token_type: "Bearer"
              | "DPoP";
              [key: string]: unknown;
          },
      >

      OAuth token response with a signed access token JWT, and a signed Refresh Token JWT when requested.

      If DPoP binding is required but missing, if Refresh Token issuance is requested without a valid DPoP configuration or lifetime, if the signer has no resolvable kid for the Refresh Token, or if response creation otherwise fails, including validation failures from the generated JWT headers or payloads.

      If the generated JWT header or payload fails validation.

    Settings

    Member Visibility