Creates a new instance of MonoCloudBackendNodeClient.
Optionaloptions: Partial<MonoCloudBackendNodeClientOptions>Client configuration options. When omitted, configuration is read from environment variables.
ProtectedclockNumber of seconds to adjust the current time to account for clock differences between the client and server during time-based claim validation. Defaults to 0.
ProtectedclockAdditional time tolerance in seconds applied when validating time-based claims (exp, nbf). Defaults to 300 (5 minutes).
Protected OptionalfetcherCustom fetch implementation used for making HTTP requests. Falls back to the global fetch if not provided.
Optionalinit: RequestInitOptionalinit: RequestInitProtected OptionaljwksCached JSON Web Key Set retrieved from the issuer's JWKS endpoint.
ProtectedjwksDuration (in seconds) for which the JWKS is cached. Defaults to 300 (5 minutes).
ProtectedjwksTimestamp (in seconds) when the cached JWKS expires.
Protected OptionalmetadataCached issuer metadata retrieved from the OpenID Connect discovery endpoint.
ProtectedmetadataDuration (in seconds) for which the metadata is cached. Defaults to 300 (5 minutes).
ProtectedmetadataTimestamp (in seconds) when the cached metadata expires.
Protected ReadonlytenantThe normalized tenant domain URL used as the base for discovery endpoints.
StaticdecodeDecodes the payload of a JSON Web Token (JWT) and returns it as an object.
Note: THIS METHOD DOES NOT VERIFY JWT TOKENS.
JWT to decode.
Decoded payload.
MonoCloudTokenError - If decoding fails
Fetches the JSON Web Keys used to sign the ID token. The JWKS is cached for 5 minutes by default.
If true, bypasses the cache and fetches fresh set of JWKS from the server.
The JSON Web Key Set containing the public keys for token verification.
MonoCloudHttpError - Thrown if there is a network error during the request or unexpected status code during the request or a serialization error while processing the response.
Fetches the authorization server metadata from the .well-known endpoint. The metadata is cached for 5 minutes by default.
If true, bypasses the cache and fetches fresh metadata from the server.
The issuer metadata for the tenant, retrieved from the OpenID Connect discovery endpoint.
MonoCloudHttpError - Thrown if there is a network error during the request or unexpected status code during the request or a serialization error while processing the response.
Validates an opaque access token using the OAuth 2.0 Token Introspection endpoint (RFC 7662).
The access token string to introspect.
Optionaloptions: IntrospectOptionsClaims validation options.
Validated access token claims (without the active field).
MonoCloudTokenError - If the token is not active or claim validation fails.
MonoCloudOPError - When the introspection endpoint returns a standardized OAuth 2.0 error response.
MonoCloudHttpError - Thrown if there is a network error during the request or unexpected status code during the request or a serialization error while processing the response.
MonoCloudValidationError - When the access token is empty or the introspection endpoint is not available in the issuer metadata or claims validation fails.
Sets clock skew used for access token time-based claim validation.
Number of seconds to adjust the current time to account for clock differences.
Sets clock tolerance used for access token time-based claim validation.
Additional time tolerance in seconds for time-based claim validation.
Validates an access token by automatically detecting its format.
The access token string to validate.
Optionaloptions: ValidateAccessTokenOptionsValidation options.
Validated access token claims.
MonoCloudValidationError - When the access token is empty.
MonoCloudTokenError - If token validation fails.
MonoCloudOPError - When the introspection endpoint returns a standardized OAuth 2.0 error response.
MonoCloudHttpError - Thrown if there is a network error during the request or unexpected status code during the request or a serialization error while processing the response.
Validates a JWT access token by verifying the signature and claims.
The access token JWT string to validate.
Optionaloptions: ValidateJwtAccessTokenOptionsValidation options.
Validated access token claims.
MonoCloudTokenError - If JWT parsing, signature verification, or claim validation fails.
MonoCloudHttpError - Thrown if there is a network error during the request or unexpected status code during the request or a serialization error while processing the response.
MonoCloudValidationError - When the access token is empty or claims validation fails.
Backend client for validating access tokens in Node.js server applications.
Extends the core OIDC backend client with caching support and automatic detection of JWT vs. opaque token formats.