ProtectedclockNumber of seconds to adjust the current time to account for clock differences between the client and server during time-based claim validation. Defaults to 0.
ProtectedclockAdditional time tolerance in seconds applied when validating time-based claims (exp, nbf). Defaults to 60 (1 minute).
Creates a new instance of MonoCloudBackendNodeClient.
Optionaloptions: Partial<MonoCloudBackendNodeClientOptions>
Client configuration options. When omitted, configuration is read from environment variables.
StaticdecodeDecodes the payload of a JSON Web Token (JWT) and returns it as an object.
Note: THIS METHOD DOES NOT VERIFY JWT TOKENS.
JWT to decode.
Decoded payload.
MonoCloudTokenError - If decoding fails
Protected OptionalfetcherCustom fetch implementation used for making HTTP requests. Falls back to the global fetch if not provided.
Optionalinit: RequestInitOptionalinit: RequestInitFetches the JSON Web Keys used to sign the ID token. The JWKS is cached for 5 minutes by default.
If true, bypasses the cache and fetches fresh set of JWKS from the server.
The JSON Web Key Set containing the public keys for token verification.
MonoCloudHttpError - Thrown if there is a network error during the request or unexpected status code during the request or a serialization error while processing the response.
Fetches the authorization server metadata from the .well-known endpoint. The metadata is cached for 5 minutes by default.
If true, bypasses the cache and fetches fresh metadata from the server.
The issuer metadata for the tenant, retrieved from the OpenID Connect discovery endpoint.
MonoCloudHttpError - Thrown if there is a network error during the request or unexpected status code during the request or a serialization error while processing the response.
Validates an opaque access token using the OAuth 2.0 Token Introspection endpoint (RFC 7662).
The access token string to introspect.
Optionaloptions: IntrospectOptions
Claims validation options.
Validated access token claims (without the active field).
MonoCloudTokenError - If the token is not active or claim validation fails.
MonoCloudOPError - When the introspection endpoint returns a standardized OAuth 2.0 error response.
MonoCloudHttpError - Thrown if there is a network error during the request or unexpected status code during the request or a serialization error while processing the response.
MonoCloudValidationError - When the access token is empty or the introspection endpoint is not available in the issuer metadata or claims validation fails.
Protected OptionaljwksCached JSON Web Key Set retrieved from the issuer's JWKS endpoint.
ProtectedjwksDuration (in seconds) for which the JWKS is cached. Defaults to 300 (5 minutes).
ProtectedjwksTimestamp (in seconds) when the cached JWKS expires.
Protected Optional ReadonlyjwksOptional custom resolver for the JSON Web Key Set, used instead of the JWKS request.
Protected OptionalmetadataCached issuer metadata retrieved from the OpenID Connect discovery endpoint.
ProtectedmetadataDuration (in seconds) for which the metadata is cached. Defaults to 300 (5 minutes).
ProtectedmetadataTimestamp (in seconds) when the cached metadata expires.
Protected Optional ReadonlymetadataOptional custom resolver for the issuer metadata, used instead of the discovery request.
ProtectedresolveResolves an endpoint URL from the issuer metadata, preferring the mutual-TLS alias when the client authenticates over mTLS.
The issuer metadata.
The endpoint to resolve.
The resolved endpoint URL.
MonoCloudValidationError - When the required endpoint is not available in the issuer metadata.
Sets clock skew used for access token time-based claim validation.
Number of seconds to adjust the current time to account for clock differences.
Sets clock tolerance used for access token time-based claim validation.
Additional time tolerance in seconds for time-based claim validation.
Protected ReadonlytenantThe normalized tenant domain URL used as the base for discovery endpoints.
Protected Optional ReadonlytrustIdentifier of the trust store whose mTLS endpoint aliases should be used, if any.
Protected ReadonlyusesWhether the configured client authentication method uses mutual TLS, and therefore requires the mTLS endpoint aliases from the issuer metadata.
Validates an access token by automatically detecting its format.
The access token string to validate.
Optionaloptions: ValidateAccessTokenOptions
Validation options.
Validated access token claims.
MonoCloudValidationError - When the access token is empty.
MonoCloudTokenError - If token validation fails.
MonoCloudOPError - When the introspection endpoint returns a standardized OAuth 2.0 error response.
MonoCloudHttpError - Thrown if there is a network error during the request or unexpected status code during the request or a serialization error while processing the response.
Validates a JWT access token by verifying the signature and claims.
The access token JWT string to validate.
Optionaloptions: ValidateJwtAccessTokenOptions
Validation options.
Validated access token claims.
MonoCloudTokenError - If JWT parsing, signature verification, or claim validation fails.
MonoCloudHttpError - Thrown if there is a network error during the request or unexpected status code during the request or a serialization error while processing the response.
MonoCloudValidationError - When the access token is empty or claims validation fails.
Backend client for validating access tokens in Node.js server applications.
Extends the core OIDC backend client with introspection caching and automatic detection of JWT vs. opaque token formats.