# `Sake.Auth.TrustedIssuer`
[🔗](https://github.com/hattoriai/sake/blob/v0.4.3/lib/sake/auth/trusted_issuer.ex#L1)

An issuer whose signed JWTs the token endpoint accepts as authorization
grants (`urn:ietf:params:oauth:grant-type:jwt-bearer`, RFC 7523). Give
them to `{Sake, auth: [trusted_issuers: [...]]}`:

    trusted_issuers: [
      [issuer: "https://acme.okta.com", clients: ["rc_..."]],
      [
        issuer: "https://token.actions.githubusercontent.com",
        profile: :workload,
        audiences: ["https://mcp.example.com"],
        clients: ["rc_..."]
      ]
    ]

Options:

  * `:issuer` (required) — the `iss` its JWTs carry, compared exactly.
  * `:profile` — `:id_jag` (the default), an enterprise identity
    provider issuing Identity Assertion JWT Authorization Grants
    (`typ` `oauth-id-jag+jwt`, with `jti`, `iat`, `sub` and a
    `client_id` that must be the authenticated client); or
    `:workload`, a platform issuing workload identity tokens (a CI
    system, a cloud, Kubernetes), whose JWTs need only `sub` and
    `exp`.
  * `:clients` (required) — the client IDs that may present its
    grants, or `:any`. A client must also have the JWT bearer grant
    type among its `grant_types`.
  * `:jwks` — its public keys, a JWK Set map; or `:jwks_uri`, where to
    fetch them. Without either, the `jwks_uri` of its OpenID Connect
    or RFC 8414 metadata is used.
  * `:audiences` — the `aud` values accepted; by default this
    authorization server's issuer and its token endpoint URL.
  * `:scopes` — the most its grants may ask for; by default anything
    the servers declare.
  * `:max_lifetime` — the longest, in seconds, a grant may still be
    valid when it is presented: one whose `exp` is further ahead is
    refused. By default 300 for `:id_jag` (an identity provider issues
    them for minutes) and 3600 for `:workload` (cloud and Kubernetes
    identity tokens commonly live an hour). It also bounds how long a
    workload token without a `jti`, which cannot be made single use,
    can be presented again.

The person or workload a grant stands for is the subject module's
`c:Sake.Auth.Subject.assertion_principal/2`; without it, every grant
is refused.

# `t`

```elixir
@type t() :: %Sake.Auth.TrustedIssuer{
  audiences: [String.t()] | nil,
  clients: [String.t()] | :any,
  issuer: String.t(),
  jwks: map() | nil,
  jwks_uri: String.t() | nil,
  max_lifetime: pos_integer(),
  profile: :id_jag | :workload,
  scopes: [String.t()] | nil
}
```

---

*Consult [api-reference.md](api-reference.md) for complete listing*