Place more than one JWT in the `client_assertion` parameter..

Condition: When using a JWT for client authentication.

The `client_assertion` MUST NOT contain more than one JWT.

Use TLS for requests to the token endpoint..

Condition: For token-endpoint requests carrying assertions.

All requests to the token endpoint MUST use TLS.

Ensure a supplied `client_id` identifies the same client as the client assertion..

Condition: When `client_id` is included with assertion-based client authentication.

If present, `client_id` MUST identify the same client as the assertion.

Include a `sub` claim whose value is the OAuth client's `client_id`..

Condition: When creating a client-authentication JWT.

For client authentication, the subject MUST be the OAuth client's `client_id`.

Include both `client_assertion_type` and `client_assertion`..

Condition: When using an assertion as a client credential.

The section marks both parameters REQUIRED.

Include the `client_id` parameter..

Condition: When using an assertion as a client credential.

The `client_id` parameter is OPTIONAL.

Accept the JWT before the time identified by its `nbf` claim..

Condition: When the JWT contains an `nbf` claim.

The `nbf` claim identifies the time before which the token MUST NOT be accepted.

Validate the JWT according to the criteria in RFC 7523 Section 3..

Condition: Before relying on a JWT for client authentication.

The authorization server MUST validate the JWT according to the listed criteria.

Reject a JWT that is invalid in any other respect under the JWT specification..

Condition: When validating the client-authentication JWT.

The authorization server MUST reject a JWT that is not valid in all other respects.

Return the `invalid_client` error code..

Condition: When the client-authentication JWT is invalid.

The `error` parameter MUST be `invalid_client`.

Include an `iss` claim and, absent an overriding application profile, compare issuer values using RFC 3986 Simple String Comparison..

Condition: When creating or validating the client-authentication JWT.

The JWT MUST contain `iss`; compliant applications MUST use Simple String Comparison unless a profile specifies otherwise.

Include an `aud` claim identifying the authorization server, reject JWTs that omit the server's identity, and, absent an overriding application profile, compare audience values using RFC 3986 Simple String Comparison..

Condition: When creating or validating the client-authentication JWT.

The JWT MUST contain `aud`; the server MUST reject an unintended audience, and compliant applications MUST use Simple String Comparison unless a profile specifies otherwise.

Include an `exp` claim and reject the JWT after its expiration time, subject to allowable clock skew..

Condition: When creating or validating the client-authentication JWT.

The JWT MUST contain `exp`, and the authorization server MUST reject an expired JWT.

Apply a digital signature or MAC to the JWT and reject an invalid signature or MAC..

Condition: When creating or validating the client-authentication JWT.

The JWT MUST be signed or MACed, and invalid signatures or MACs MUST be rejected.

Accept a requested authentication method name that matches an existing registered name case-insensitively..

Condition: When reviewing a registry request.

Names matching registered names in a case-insensitive manner SHOULD NOT be accepted.

Use asymmetric cryptography for client authentication, such as mutual TLS or `private_key_jwt`..

Condition: When selecting a client authentication method.

Asymmetric cryptography is RECOMMENDED for client authentication.