Confidential Clients (private_key_jwt)

import { HawcxOAuth, ClientAssertionSigner } from '@hawcx/oauth-client';

const oauth = (await HawcxOAuth.fromIssuer({
  issuer: process.env.HAWCX_BASE_URL!,
  configId: process.env.HAWCX_CONFIG_ID!,
  clientId: process.env.HAWCX_CLIENT_ID!,
})).withClientAssertion(
  ClientAssertionSigner.ed25519FromJwk(process.env.HAWCX_OAUTH_PRIVATE_KEY_JWK!),
);

// Same call as a public client — the assertion is attached automatically.
const { idToken, claims } = await oauth.exchangeCode(code, codeVerifier);

from hawcx_backend_sdk.oauth import HawcxOAuth, ClientAssertionSigner

oauth = HawcxOAuth.from_issuer(
    os.environ["HAWCX_BASE_URL"],
    os.environ["HAWCX_CONFIG_ID"],
    os.environ["HAWCX_CLIENT_ID"],
).with_client_assertion(
    ClientAssertionSigner.ed25519_from_jwk(os.environ["HAWCX_OAUTH_PRIVATE_KEY_JWK"])
)

result = oauth.exchange_code(code, code_verifier)  # assertion attached automatically
claims = result.claims

import com.hawcx.oauth.HawcxOauthClient;
import com.hawcx.oauth.ClientAssertionSigner;

HawcxOauthClient oauth = HawcxOauthClient
    .fromIssuer(System.getenv("HAWCX_BASE_URL"),
                System.getenv("HAWCX_CONFIG_ID"),
                System.getenv("HAWCX_CLIENT_ID"))
    .withClientAssertion(
        ClientAssertionSigner.ed25519FromJwk(System.getenv("HAWCX_OAUTH_PRIVATE_KEY_JWK")));

String idToken = oauth.exchangeCodeForIdToken(code, codeVerifier); // assertion attached
Map<String, Object> claims = oauth.verifyToken(idToken);

import { SignJWT, importJWK } from 'jose';
import { randomUUID } from 'node:crypto';

const privateJwk = JSON.parse(process.env.HAWCX_OAUTH_PRIVATE_KEY_JWK!);
const signingKey = await importJWK(privateJwk, 'EdDSA');

const now = Math.floor(Date.now() / 1000);
const clientAssertion = await new SignJWT({})
  .setProtectedHeader({ alg: 'EdDSA', typ: 'JWT', kid: privateJwk.kid })
  .setIssuer(CLIENT_ID)         // iss = client_id
  .setSubject(CLIENT_ID)        // sub = client_id
  .setAudience(TOKEN_ENDPOINT)  // aud = discovered token_endpoint
  .setIssuedAt(now)
  .setExpirationTime(now + 60)  // <= 120s
  .setJti(randomUUID())
  .sign(signingKey);

const res = await fetch(TOKEN_ENDPOINT, {
  method: 'POST',
  headers: {
    'Content-Type': 'application/x-www-form-urlencoded',
    'X-Config-Id': CONFIG_ID,
  },
  body: new URLSearchParams({
    code,
    code_verifier: codeVerifier,
    client_id: CLIENT_ID,
    client_assertion_type: 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer',
    client_assertion: clientAssertion,
  }),
});
const { id_token } = await res.json();
// Then verify id_token — see "ID Token Verification".

import json, os, time, uuid
import jwt  # PyJWT
import requests

private_jwk = json.loads(os.environ["HAWCX_OAUTH_PRIVATE_KEY_JWK"])
# PyJWT loads an Ed25519 (OKP) private key straight from the JWK:
signing_key = jwt.algorithms.OKPAlgorithm.from_jwk(json.dumps(private_jwk))

now = int(time.time())
client_assertion = jwt.encode(
    {
        "iss": CLIENT_ID,       # iss = client_id
        "sub": CLIENT_ID,       # sub = client_id
        "aud": TOKEN_ENDPOINT,  # aud = discovered token_endpoint
        "iat": now,
        "exp": now + 60,        # <= 120s
        "jti": str(uuid.uuid4()),
    },
    signing_key,
    algorithm="EdDSA",
    headers={"typ": "JWT", "kid": private_jwk["kid"]},
)

resp = requests.post(
    TOKEN_ENDPOINT,
    headers={
        "Content-Type": "application/x-www-form-urlencoded",
        "X-Config-Id": CONFIG_ID,
    },
    data={
        "code": code,
        "code_verifier": code_verifier,
        "client_id": CLIENT_ID,
        "client_assertion_type": "urn:ietf:params:oauth:client-assertion-type:jwt-bearer",
        "client_assertion": client_assertion,
    },
)
id_token = resp.json()["id_token"]
# Then verify id_token — see "ID Token Verification".

import com.nimbusds.jose.*;
import com.nimbusds.jose.crypto.Ed25519Signer;
import com.nimbusds.jose.jwk.OctetKeyPair;
import com.nimbusds.jwt.*;
import java.time.Instant;
import java.util.Date;
import java.util.UUID;

OctetKeyPair jwk = OctetKeyPair.parse(privateJwkJson);   // Ed25519 OKP private key
Instant now = Instant.now();

JWTClaimsSet claims = new JWTClaimsSet.Builder()
    .issuer(CLIENT_ID)                                   // iss = client_id
    .subject(CLIENT_ID)                                  // sub = client_id
    .audience(TOKEN_ENDPOINT)                            // aud = discovered token_endpoint
    .issueTime(Date.from(now))
    .expirationTime(Date.from(now.plusSeconds(60)))      // <= 120s
    .jwtID(UUID.randomUUID().toString())
    .build();

SignedJWT assertion = new SignedJWT(
    new JWSHeader.Builder(JWSAlgorithm.EdDSA)
        .type(JOSEObjectType.JWT)
        .keyID(jwk.getKeyID())
        .build(),
    claims);
assertion.sign(new Ed25519Signer(jwk));
String clientAssertion = assertion.serialize();

// POST form to {issuer}/oauth2/token with header X-Config-Id and fields:
//   code, code_verifier, client_id,
//   client_assertion_type = urn:ietf:params:oauth:client-assertion-type:jwt-bearer,
//   client_assertion      = clientAssertion
// Then verify the returned id_token — see "ID Token Verification".