include more than one JWT in the `client_assertion` parameter.

Condition: when using a JWT bearer token for client authentication

It MUST NOT contain more than one JWT.

ensure that `client_id` identifies the same client as the client assertion.

Condition: if `client_id` is present

If present, the value of the "client_id" parameter MUST identify the same client as is identified by the client assertion.

include an `iss` claim containing a unique identifier for the JWT issuer.

The JWT MUST contain an "iss" (issuer) claim that contains a unique identifier for the entity that issued the JWT.

include a `sub` claim identifying the JWT subject.

The JWT MUST contain a "sub" (subject) claim identifying the principal that is the subject of the JWT.

set the `sub` claim to the OAuth client's `client_id`.

Condition: when the JWT is used for client authentication

For client authentication, the subject MUST be the "client_id" of the OAuth client.

include an `aud` claim identifying the authorization server as an intended audience.

The JWT MUST contain an "aud" (audience) claim containing a value that identifies the authorization server as an intended audience.

include an `exp` claim limiting the JWT's usable time window.

The JWT MUST contain an "exp" (expiration time) claim that limits the time window during which the JWT can be used.

digitally sign the JWT or apply a MAC.

The JWT MUST be digitally signed or have a Message Authentication Code (MAC) applied by the issuer.

include the `client_assertion_type` parameter.

Condition: when using an assertion as a client credential

client_assertion_type REQUIRED.

include the `client_assertion` parameter.

Condition: when using an assertion as a client credential

client_assertion REQUIRED.

use the authorization server's token endpoint URL as an `aud` value.

The token endpoint URL of the authorization server MAY be used as a value for an "aud" element.

include an `nbf` claim.

The JWT MAY contain an "nbf" (not before) claim.

include an `iat` claim.

The JWT MAY contain an "iat" (issued at) claim.

include a `jti` claim providing a unique identifier for the JWT.

The JWT MAY contain a "jti" (JWT ID) claim that provides a unique identifier for the token.

include other claims in the JWT.

The JWT MAY contain other claims.

include the `client_id` parameter.

Condition: when using an assertion as a client credential

client_id OPTIONAL.

accept the JWT for processing before the time identified by its `nbf` claim.

Condition: when an `nbf` claim is present

the time before which the token MUST NOT be accepted for processing.

validate the JWT according to the criteria in RFC 7523 Section 3.

Condition: when relying on a JWT for client authentication

the authorization server MUST validate the JWT according to the criteria below.

reject a JWT that does not identify it as an intended audience.

The authorization server MUST reject any JWT that does not contain its own identity as the intended audience.

reject a JWT whose expiration time has passed, subject to allowable clock skew.

The authorization server MUST reject any JWT with an expiration time that has passed, subject to allowable clock skew between systems.

reject JWTs with an invalid signature or MAC.

The authorization server MUST reject JWTs with an invalid signature or MAC.

reject a JWT that is otherwise invalid under the JWT specification.

The authorization server MUST reject a JWT that is not valid in all other respects per "JSON Web Token (JWT)".

use the `invalid_client` error code.

Condition: if the client JWT is invalid

The value of the "error" parameter MUST be the "invalid_client" error code.

prevent replay by retaining used `jti` values for the JWT validity period.

Condition: when a `jti` claim is used

The authorization server MAY ensure that JWTs are not replayed by maintaining the set of used "jti" values.

include `error_description` or `error_uri` information explaining why the JWT was invalid.

Condition: if the client JWT is invalid

The authorization server MAY include additional information regarding the reasons the JWT was considered invalid.

compare issuer values using RFC 3986 simple string comparison.

Condition: in the absence of an application profile specifying otherwise

compliant applications MUST compare issuer values using the Simple String Comparison method defined in Section 6.2.1 of RFC 3986.

compare audience values using RFC 3986 simple string comparison.

Condition: in the absence of an application profile specifying otherwise

compliant applications MUST compare the audience values using the Simple String Comparison method defined in Section 6.2.1 of RFC 3986.