AXIAM PHP SDK

__construct()

Constructs a CreateOAuth2ClientRequest.

Parameters

$grantTypes : array<int, string>

Grant types this client is authorized to use.

$name : string

Human-readable name for the client.

$redirectUris : array<int, string>

Allowed redirect URIs (must be HTTPS, except localhost for dev). SEC-089: this list doubles as the token-exchange audience allow-list — adding a URI here also authorises it as a token audience for this client, so review additions on exchange-capable clients with that in mind (see docs/api/token-exchange.md#audience).

$scopes : array<int, string>

Scopes the client may request.

$backchannelLogoutUri : string|null = null

B5 — where OIDC back-channel logout tokens are delivered. Omit for a client that does not participate. (optional)

$dpopBoundAccessTokens : bool|null = null

RFC 9449 §5.2 — issue DPoP-bound (sender-constrained) access tokens to this client. Independent of both the authentication method and tls_client_certificate_bound_access_tokens; a client may ask for both constraints, and a token carrying both must satisfy both. (optional)

$dpopRequireNonce : bool|null = null

RFC 9449 §8 — require this client's DPoP proofs to carry a server-issued nonce. Not implemented in this build (SEC-097). true is refused with 400; only false (the default) is accepted. Nothing reads the stored value, so accepting true would persist and echo back a security switch that does nothing. DPoP proofs are made single-use at the token endpoint by jti replay detection instead — see docs/security-profiles.md. (optional)

$jwks : string|null = null

RFC 7591 §2 — the client's public key set, inline, for private_key_jwt. Exactly one of jwks and jwks_uri may be set. (optional)

$jwksUri : string|null = null

RFC 7591 §2 — where the client publishes its public key set. Must be an absolute https URL, and is fetched through the SSRF-guarded JWKS cache, which refuses private and loopback addresses. (optional)

$postLogoutRedirectUris : array<int, string>|null = null

B5 — allow-list for RP-initiated logout's post_logout_redirect_uri. Separate from redirect_uris on purpose: that list receives authorization codes, this one receives a browser after logout. (optional)

$profile : ClientProfile|null = null

X5.1 — the security posture this client is registered under. "standard" (the default) is every AXIAM client that has ever existed. "fapi2" turns on the whole FAPI 2.0 constraint bundle at once, and the registration is refused unless it also sets require_par, a strong token_endpoint_auth_method (either mTLS method or private_key_jwt), and at least one sender-constraining mechanism (tls_client_certificate_bound_access_tokens or dpop_bound_access_tokens). See the FAPI operator guide. (optional)

$requirePar : bool|null = null

B5 — require this client to push its authorization parameters to /oauth2/par (RFC 9126) rather than sending them through the browser. (optional)

$selfSignedTlsClientAuthThumbprints : array<int, string>|null = null

Accepted certificate thumbprints for self_signed_tls_client_auth, as base64url-unpadded SHA-256 digests of the DER certificate (the same x5t#S256 encoding as the cnf claim). More than one permits an overlapping rotation. (optional)

$tlsClientAuthSanDns : string|null = null

RFC 8705 §2.1.2 — expected dNSName SAN. (optional)

$tlsClientAuthSanUri : string|null = null

RFC 8705 §2.1.2 — expected uniformResourceIdentifier SAN. (optional)

$tlsClientAuthSubjectDn : string|null = null

RFC 8705 §2.1.2 — expected certificate subject DN, RFC 4514 form. Exactly one of the three tls_client_auth_* parameters may be set. (optional)

$tlsClientCertificateBoundAccessTokens : bool|null = null

RFC 8705 §3.4 — issue certificate-bound (sender-constrained) access tokens to this client. Independent of the authentication method. (optional)

$tokenEndpointAuthMethod : ClientAuthMethod|null = null

X5.1 — how this client authenticates at the token endpoint (RFC 8705 §2). Defaults to client_secret_post. (optional)

jsonSerialize()

Renders this object for `json_encode()`.

toArray()

Renders this object back to its wire form.