Signing JWT used for client assertion using an external system

[vivshankar]

Long time user of this library and absolutely love it!

The current implementation of openid-client appears to require that the private key be packaged with the client application and be supplied to support private_key_jwt client authentication method. However, there are cases where the JWT may be signed through a system like Hashicorp Vault that offers JWT signing services. This allows the private key to remain within the crypto service.

Is there any way this can be accomplished currently with this library?

[panva]

Is there any way this can be accomplished currently with this library?

Through an implementation of the ClientAuth interface.

[vivshankar]

Thanks @panva . That makes sense. Let me give that a try.