IO Wallet SDK
    Preparing search index...

    Interface CreateAccessTokenResponseOptions

    interface CreateAccessTokenResponseOptions {
        additionalPayload?: Record<string, unknown>;
        audience: string;
        authorizationServer: string;
        callbacks: Pick<CallbackContext, "generateRandom" | "hash" | "signJwt">;
        clientId: string;
        dpop?: {
            jwk: {
                alg?: string;
                crv?: string;
                d?: string;
                dp?: string;
                dq?: string;
                e?: string;
                ext?: boolean;
                k?: string;
                key_ops?: string[];
                kid?: string;
                kty: string;
                n?: string;
                oth?: { d?: string; r?: string; t?: string; [key: string]: unknown }[];
                p?: string;
                q?: string;
                qi?: string;
                use?: string;
                x?: string;
                x5c?: string[];
                x5t?: string;
                "x5t#S256"?: string;
                x5u?: string;
                y?: string;
                [key: string]: unknown;
            };
        };
        expiresInSeconds: number;
        nbf?: number;
        now?: Date;
        refreshTokenExpiresInSeconds?: number;
        scope?: string;
        signer: JwtSigner;
        subject: string;
        tokenType: "Bearer"
        | "DPoP";
    }
    Index

    Properties

    additionalPayload? audience authorizationServer callbacks clientId dpop? expiresInSeconds nbf? now? refreshTokenExpiresInSeconds? scope? signer subject tokenType

    Properties

    additionalPayload?: Record<string, unknown>

    Additional claims copied into both the access token JWT payload and token response envelope.

    audience: string

    Intended recipient of the access token (aud claim).

    authorizationServer: string

    Authorization server identifier (iss claim).

    callbacks: Pick<CallbackContext, "generateRandom" | "hash" | "signJwt">

    Runtime callbacks used to generate random values, compute JWK thumbprints, and sign the access token JWT.

    clientId: string

    OAuth client identifier (client_id claim).

    dpop?: {
        jwk: {
            alg?: string;
            crv?: string;
            d?: string;
            dp?: string;
            dq?: string;
            e?: string;
            ext?: boolean;
            k?: string;
            key_ops?: string[];
            kid?: string;
            kty: string;
            n?: string;
            oth?: { d?: string; r?: string; t?: string; [key: string]: unknown }[];
            p?: string;
            q?: string;
            qi?: string;
            use?: string;
            x?: string;
            x5c?: string[];
            x5t?: string;
            "x5t#S256"?: string;
            x5u?: string;
            y?: string;
            [key: string]: unknown;
        };
    }

    DPoP public key used to bind the access token (cnf.jkt claim).

    expiresInSeconds: number

    Access token lifetime in seconds, used for both exp and expires_in.

    nbf?: number

    Optional "not before" timestamp in epoch seconds (nbf claim).

    now?: Date

    Reference time used for iat and exp. Defaults to current time.

    refreshTokenExpiresInSeconds?: number

    Requests issuance of a DPoP-bound Refresh Token JWT by specifying its lifetime in seconds. The Refresh Token exp is set to now + refreshTokenExpiresInSeconds and must be later than the Access Token exp (nbf of the Refresh Token).

    Requires tokenType to be DPoP and dpop to be provided. Omit this option to keep the specification's optional Refresh Token behavior (e.g. Bearer-only PDND responses).

    scope?: string

    Optional scope string included in both the access token JWT payload and token response envelope.

    signer: JwtSigner

    Signer used to produce the access token JWT.

    subject: string

    Subject identifier represented by the access token (sub claim).

    tokenType: "Bearer" | "DPoP"

    Token type returned in the OAuth token response. NOTE: When using Bearer it is supposed to be used only for PDND Interoperability API, not for credential issuance flows.

    Settings

    Member Visibility

    On This Page

    Properties