16 August 2026: credentials and JWT assertion

Updated: 16 August 2026

Identifier details now manage secret lifetime, and the wizard supports a third client type: private_key_jwt.

Compatibility
Existing confidential / public clients do not need code changes. If you lose a client_secret, rotate it instead of deleting the identifier.

Summary

• Confidential clients can rotate client_secret from identifier details (this also updates the data-deletion signing key).
• Public / JWT clients can issue or rotate webhookSecret after creation.
• The wizard adds a JWT assertion client: the portal stores only an EC P-256 public key; the token endpoint uses private_key_jwt and issues a refresh_token.
• JWT clients can add more public keys (kid) from the detail page for zero-downtime rotation.

Concept and trade-offs: Registration and configuration (“What JWT assertion is”). Token-exchange claims and request shape: Authorization code and PKCE and Examples and troubleshooting. Deletion-callback signing: Scopes and consent.