Optional ReadonlyallowedAudience values this client may receive tokens for. Grants that issue
tokens directly from the client record select the first entry as the
default aud; absence falls back to the issuer.
Optional ReadonlyallowedPer-client grant-type gate, mirrored from the client registration by
clientAuthMw. Enforced centrally by isGrantTypeAllowed at grant
dispatch and at /authorize, so every grant inherits the check (#268);
client_credentials and the WebAuthn grant layer a stricter
deny-by-absence rule on top. The absent / empty / non-empty semantics
are documented once, on Client.allowedGrantTypes in
../repositories/types.mts.
Optional ReadonlyallowedPer-client allowed scope ceiling. Grant handlers that issue tokens
directly from the client record (e.g., client_credentials, which has
no upstream RT/code carrying a scope claim) compare requested scopes
against this list and emit invalid_scope on disjoint sets.
Optional ReadonlyallowPer-client opt-in for the RFC 7636 plain PKCE challenge method (#273).
The /token route propagates it from req.oauthClient so the
authorization-code grant applies the same per-client method list
/authorize applied when it minted the code. Semantics are documented
once, on Client.allowPlainPkce in ../repositories/types.mts.
ReadonlyclientOptional ReadonlydefaultWhat an omitted scope grants (#396) — mirrored from the client
registration. Absent + non-empty allowedScopes means a scope-omitting
request answers invalid_scope instead of receiving the whole ceiling.
Optional ReadonlysenderPer-client sender-constraint requirement. The /token route
propagates this from req.oauthClient; the shared grant-dispatch
path enforces the binding-method rules in spec §4.8 step 2 before
invoking the concrete grant handler.
Readonlytoken
The client identity established by RFC 6749 §2.3 token-endpoint authentication middleware (
clientAuthMw) before a grant handler is invoked.Every grant handler that gates on client identity (refresh, authorization code, token-exchange) MUST consult this slot rather than the raw request body — body parameters are attacker-controlled and may differ from the authenticated identity.
nullindicates the request did not pass throughclientAuthMw(e.g., a custom route, or a unit test invoking the handler directly with a hand-builtGrantContext).