# `Sake.Auth.Client`
[🔗](https://github.com/hattoriai/sake/blob/v0.4.3/lib/sake/auth/client.ex#L1)

An OAuth client: from a Client ID Metadata Document, dynamically
registered, or registered by the host.

A client registered for `private_key_jwt` authentication carries its
public keys: a JWK Set in `jwks`, or the URL of one in `jwks_uri`.

`dpop_bound_access_tokens` (RFC 9449 §5.2) says the client always uses
DPoP: its token requests without a proof are refused.

`require_pushed_authorization_requests` (RFC 9126 §6) says the client
only ever pushes its authorization requests: with `par:` on, the
authorize endpoint refuses its requests that were not pushed.

`inserted_at` is when it was registered: a dynamically registered
client that never came to hold a token or a consent is pruned some time
after (see `Sake.Auth.prune/1`).

# `t`

```elixir
@type t() :: %Sake.Auth.Client{
  application_type: term(),
  client_uri: term(),
  dpop_bound_access_tokens: term(),
  grant_types: term(),
  id: term(),
  inserted_at: term(),
  jwks: term(),
  jwks_uri: term(),
  kind: term(),
  logo_uri: term(),
  name: term(),
  redirect_uris: term(),
  require_pushed_authorization_requests: term(),
  scopes: term(),
  secret_hash: term(),
  token_endpoint_auth_method: term()
}
```

---

*Consult [api-reference.md](api-reference.md) for complete listing*