Concierge.Auth.Client.Tokens 1.0.0

Concierge.Auth.Client.Tokens

Obtains typ: "client" JWTs from POST /api/v1/auth/token (contract §11.3) and attaches them to outbound HTTP calls. Counterpart to Concierge.Auth.Client.AuthGuard's JWT validation lane — AuthGuard validates a client JWT someone else issued; this package is how a client service obtains one. Not the deprecated human JWT pair in Concierge.Auth.Client.Sessions/Tokens/JwtLaneCredential.cs.

Install and register

services.AddConciergeAuthClient(configuration, db => db.UseNpgsql(cs, npgsql =>
    npgsql.MigrationsHistoryTable("__EFMigrationsHistory", "concierge"))); // base — required first
services.AddConciergeSecretManagement(configuration);                        // Secrets — required first
services.AddConciergeAuthClientTokens(configuration);                        // binds "Concierge:AuthClient:ClientTokens"

AddConciergeAuthClientTokens fails closed at this call, synchronously, if AddConciergeSecretManagement(...) has not already been registered — minting authenticates with this service's own credential from IClientCredentialStore.

Attach to an outbound HttpClient

services.AddHttpClient<MyDownstreamClient>()
    .AddHttpMessageHandler<ConciergeClientTokenHandler>();

ConciergeClientTokenHandler is registered as transient by AddConciergeAuthClientTokens — use AddHttpMessageHandler<ConciergeClientTokenHandler>() (not a manual new).

IClientTokenProvider

var token = await clientTokenProvider.GetTokenAsync(cancellationToken);

In-memory cache with single-flight refresh. A token is served while now < expiry - RefreshSkew (default 60 seconds). Failed mints are not cached — the next call retries. No refresh token: a machine holding a durable secret re-mints.

Failure codes:

Credential-store failures propagate their own Error from IClientCredentialStore.

Configuration

ConciergeClientTokensOptions is a fourth similarly-named options type — do not confuse it with ConciergeTokenValidationOptions (AuthGuard, validating an incoming JWT) or ConciergeSessionsOptions (Sessions, obtaining a human session).

ConciergeClientTokenHandler retry semantics

Sets Authorization: Bearer <token>. On a downstream 401, invalidates the cache and retries exactly once with a freshly minted token. A second 401 propagates unchanged. Non-401 failures are never swallowed.