Authenticate OAuth clients with private_key_jwt instead of client secrets

Steps

1. Generate an RSA or EC key pair for your client; register the public key (as a JWK or JWKS URI) with your authorization server so it can verify your assertions.
2. At token request time, build a JWT assertion with claims: iss and sub both set to your client_id, aud set to the token endpoint URL, jti set to a unique nonce, and exp set to a short expiry (a few minutes is sufficient).
3. Sign the JWT with your private key using an algorithm the authorization server supports (e.g., RS256 or ES256).
4. POST to the token endpoint with client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer and client_assertion set to the signed JWT, alongside your normal grant parameters.
5. Rotate your key pair periodically; publish the new public key to your JWKS URI before retiring the old private key so the authorization server can validate tokens signed with either key during the transition.
6. Store the private key in a secrets manager or HSM; never embed it in source code or environment variables in plaintext.