RFC 7523 JWT Bearer Provider

Exchanges ID tokens for OAuth2 access tokens with the RFC 7523 jwt-bearer grant, sending the identity token as the assertion, and refreshes them before expiration.

Package pkg/rfc7523. Snippets assume the common setup; Channel Behavior explains the result channel.

import (
    "go.riptides.io/tokenex/pkg/credential"
    "go.riptides.io/tokenex/pkg/rfc7523"
)

provider, err := rfc7523.NewCredentialsProvider(ctx, logr.Discard())
if err != nil {
    log.Fatalf("new provider: %v", err)
}

credCh, err := provider.GetCredentials(ctx, "https://auth.example.com/oauth2/token", idTokenProvider,
    rfc7523.WithScopes([]string{"api.read"}),
)
if err != nil {
    log.Fatalf("get credentials: %v", err)
}

for cred := range credCh {
    if cred.Err != nil {
        log.Printf("token error: %v", cred.Err)
        break
    }
    tok := cred.Credential.(*credential.Oauth2Creds)
    log.Printf("got access token, expires %s", tok.Expiry)
}

The request is form-encoded by default. WithBodyFormat(rfc7523.BodyFormatJSON) sends JSON instead, and WithAdditionalParams (form) or WithAdditionalFields (JSON) add endpoint-specific fields.

Anthropic Workload Identity Federation

rfc7523.GetAnthropicCredentials exchanges the identity token at Anthropic’s Workload Identity Federation endpoint. The token’s audience must match the federation rule.

credCh, err := rfc7523.GetAnthropicCredentials(ctx, logr.Discard(), idTokenProvider, rfc7523.AnthropicWIFConfig{
    FederationRuleID: "fdrl_...",
    OrganizationID:   "...",
    ServiceAccountID: "...",
    WorkspaceID:      "...",
})

The GitHub Actions doc has a complete example.