File Extension/Auth/ClientCredentials/PrivateKeyJwtCredential.php

1:	<?php
2:
3:	declare(strict_types=1);
4:
5:	/**
6:	* This file is part of the Nexus MCP SDK package.
7:	*
8:	* (c) 2026 John Paul E. Balandan, CPA <paulbalandan@gmail.com>
9:	*
10:	* For the full copyright and license information, please view
11:	* the LICENSE file that was distributed with this source code.
12:	*/
13:
14:	namespace Nexus\Mcp\Extension\Auth\ClientCredentials;
15:
16:	use Nexus\Assert\Assert;
17:
18:	/**
19:	* Pre-registered client identity presented with `private_key_jwt` authentication: a signed JWT client
20:	* assertion in place of a shared secret.
21:	*
22:	* @see https://datatracker.ietf.org/doc/html/rfc7523#section-2.2
23:	*/
24:	final readonly class PrivateKeyJwtCredential
25:	{
26:	/**
27:	* @param non-empty-string $clientId
28:	* @param non-empty-string $privateKeyPem The signing key in PEM form
29:	* @param non-empty-string $algorithm The JWS algorithm registered for the client, e.g. `ES256`
30:	* @param null\|non-empty-string $keyId The `kid` stamped on the assertion header, when the server keys by one
31:	*/
32:	public function __construct(
33:	public string $clientId,
34:	public string $privateKeyPem,
35:	public string $algorithm,
36:	public ?string $keyId = null,
37:	) {
38:	Assert::that($clientId)->isNonEmptyString('"clientId" must be a non-empty string.');
39:	Assert::that($privateKeyPem)->isNonEmptyString('"privateKeyPem" must be a non-empty string.');
40:	Assert::that($algorithm)->isNonEmptyString('"algorithm" must be a non-empty string.');
41:	Assert::that($keyId)->nullOr()->isNonEmptyString('"keyId" must be a non-empty string or null.');
42:	}
43:	}
44:

Namespaces

Classes