Build a client assertion

A client assertion is a short-lived JWT, signed with your private key. You send it with each token request instead of a client secret. This is the OAuth 2.0 private_key_jwt method from RFC 7523.

Header

algstringrequired

Always RS256.

typstring

JWT.

No kid is needed. Ryno verifies the signature against the one certificate you registered.

Claims

issstringrequired

Your client ID.

substringrequired

Your client ID, the same as iss.

audstringrequired

The exact token endpoint URL for the environment. See Environments.

jtistringrequired

A new unique value for every assertion. Use a UUID. A reused assertion is rejected.

iatnumberrequired

The current time, in Unix seconds.

expnumberrequired

Expiry, in Unix seconds. Use 60 seconds after iat.

Rules

• Sign a fresh assertion for every token request. Never cache or reuse one.
• An assertion is not an access token. Never send it to the API.
• Keep your server clock synchronised with NTP. Clock drift is the most common cause of rejected assertions.

Decoded assertion

// Header
{
  "alg": "RS256",
  "typ": "JWT"
}

// Claims
{
  "iss": "acme-ltd-d82dc280d10340eca66ad11bc2c3295e",
  "sub": "acme-ltd-d82dc280d10340eca66ad11bc2c3295e",
  "aud": "https://keycloak.sandbox.rynopay.io/realms/ryno/protocol/openid-connect/token",
  "jti": "5f0c7a5e-1c1b-4a7e-9a3f-2f6f6c1f4d10",
  "iat": 1790995200,
  "exp": 1790995260
}

Node.js

const assertion = await new SignJWT({})
  .setProtectedHeader({ alg: 'RS256', typ: 'JWT' })
  .setIssuer(CLIENT_ID)
  .setSubject(CLIENT_ID)
  .setAudience(TOKEN_URL)
  .setJti(randomUUID())
  .setIssuedAt()
  .setExpirationTime('60s')
  .sign(privateKey);

Complete clients: Node.js, Python, C#.