Ensure that `client_id` identifies the same client as the client assertion..

Condition: when `client_id` is present with assertion-based client authentication

the "client_id" parameter MUST identify the same client as is identified by the client assertion.

Include the `client_assertion_type` parameter..

Condition: when using an assertion for client authentication

client_assertion_type REQUIRED.

Include the `client_assertion` parameter containing the assertion used to authenticate the client..

Condition: when using an assertion for client authentication

client_assertion REQUIRED.

Include the `client_id` parameter..

Condition: when using an assertion for client authentication

client_id OPTIONAL.

Accept the JWT for processing before its `nbf` time..

Condition: when the JWT contains an `nbf` claim

the time before which the token MUST NOT be accepted for processing.

Validate the JWT according to the profile's processing criteria..

Condition: before relying on the JWT for client authentication

the authorization server MUST validate the JWT according to the criteria below.

Reject a JWT that does not identify the authorization server as an intended audience..

Condition: when validating the JWT audience

The authorization server MUST reject any JWT that does not contain its own identity as the intended audience.

Reject a JWT whose expiration time has passed, subject to allowable clock skew..

Condition: when validating the JWT expiration

The authorization server MUST reject any JWT with an expiration time that has passed

Reject a JWT with an invalid signature or MAC..

Condition: when validating JWT integrity

The authorization server MUST reject JWTs with an invalid signature or MAC.

Reject a JWT that is otherwise invalid under the JWT specification..

Condition: when evaluating a client authentication JWT

The authorization server MUST reject a JWT that is not valid in all other respects per "JSON Web Token (JWT)".

Use the `invalid_client` error code..

Condition: when the client JWT is invalid

The value of the "error" parameter MUST be the "invalid_client" error code.

Support `RS256` for JWT client authentication signatures..

Condition: when publishing OAuth authorization server metadata for supported token endpoint signing algorithms

Servers SHOULD support "RS256".

Enforce client authentication..

Condition: when credential issuance or registration and credential confidentiality are feasible for the deployment

Authorization servers SHOULD enforce client authentication if it is feasible

Prevent replay by retaining used `jti` values for the JWT's validity period..

Condition: when the JWT contains a `jti` claim

The authorization server MAY ensure that JWTs are not replayed by maintaining the set of used "jti" values

Include `error_description` or `error_uri` information explaining why the JWT was invalid..

Condition: when returning an error for an invalid client JWT

The authorization server MAY include additional information regarding the reasons the JWT was considered invalid

List `none` as a token endpoint client-authentication signing algorithm..

Condition: in `token_endpoint_auth_signing_alg_values_supported`

The value "none" MUST NOT be used.

Include `token_endpoint_auth_signing_alg_values_supported`..

Condition: when `token_endpoint_auth_methods_supported` includes `private_key_jwt`

This metadata entry MUST be present if either of these authentication methods are specified

Contain more than one JWT..

Condition: when carrying a JWT used for client authentication

It MUST NOT contain more than one JWT.

Compare issuer values using RFC 3986 Simple String Comparison..

Condition: in the absence of an application profile specifying otherwise

compliant applications MUST compare issuer values using the Simple String Comparison method

Compare audience values using RFC 3986 Simple String Comparison..

Condition: in the absence of an application profile specifying otherwise

compliant applications MUST compare the audience values using the Simple String Comparison method

Contain an `iss` claim with a unique identifier for the issuer..

Condition: when used for client authentication

The JWT MUST contain an "iss" (issuer) claim

Contain a `sub` claim identifying its subject..

Condition: when used for client authentication

The JWT MUST contain a "sub" (subject) claim

Use the OAuth client's `client_id` as the `sub` value..

Condition: when used for client authentication

For client authentication, the subject MUST be the "client_id" of the OAuth client.

Contain an `aud` claim identifying the authorization server as an intended audience..

Condition: when used for client authentication

The JWT MUST contain an "aud" (audience) claim

Contain an `exp` claim limiting its usable time window..

Condition: when used for client authentication

The JWT MUST contain an "exp" (expiration time) claim

Contain an `nbf` claim identifying the time before which it cannot be accepted..

Condition: when a not-before restriction is needed

The JWT MAY contain an "nbf" (not before) claim

Contain an `iat` claim identifying its issuance time..

The JWT MAY contain an "iat" (issued at) claim

Contain a `jti` claim providing a unique token identifier..

The JWT MAY contain a "jti" (JWT ID) claim

Contain claims other than those defined by the profile..

The JWT MAY contain other claims.

Digitally sign the JWT or apply a MAC..

Condition: under the general RFC 7523 JWT profile

The JWT MUST be digitally signed or have a Message Authentication Code (MAC) applied by the issuer.

Use the authorization server's token endpoint URL as an `aud` value..

Condition: when identifying the authorization server as an intended audience

The token endpoint URL of the authorization server MAY be used as a value for an "aud" element

Use asymmetric cryptography, including signed JWTs using Private Key JWT, for client authentication..

It is RECOMMENDED to use asymmetric cryptography for client authentication

Accept a requested method name that matches an existing registered name case-insensitively..

Condition: when evaluating a new registry registration

Names that match other registered names in a case-insensitive manner SHOULD NOT be accepted.