OidcTokenSet
in package
A token set returned by the OAuth2 token endpoint (wire schema `TokenResponse`), returned by `oidcExchange`, `oidcRefresh` and `loginClientCredentials` (CONTRACT.md §12.1).
$accessToken, $refreshToken and $idToken are Sensitive (§12.5):
__toString()/var_dump()/json_encode() all redact them to "[SENSITIVE]", and the
raw value is reachable only through ->reveal().
$idClaims is present exactly when $idToken is, and holds the already-validated
claim set (§12.4) — validation happens before this object is ever constructed, so an
OidcTokenSet in your hands is never partially trusted (§12.4 rule 7).
Table of Contents
Properties
- $accessToken : Sensitive
- $expiresIn : int
- $idClaims : array<string|int, mixed>|null
- $idToken : Sensitive|null
- $refreshToken : Sensitive|null
- $scope : string|null
- $tokenType : string
Methods
- __construct() : mixed
Properties
$accessToken read-only
public
Sensitive
$accessToken
$expiresIn read-only
public
int
$expiresIn
$idClaims read-only
public
array<string|int, mixed>|null
$idClaims
= null
$idToken read-only
public
Sensitive|null
$idToken
= null
$refreshToken read-only
public
Sensitive|null
$refreshToken
= null
$scope read-only
public
string|null
$scope
= null
$tokenType read-only
public
string
$tokenType
Methods
__construct()
public
__construct(Sensitive $accessToken, string $tokenType, int $expiresIn[, string|null $scope = null ][, Sensitive|null $refreshToken = null ][, Sensitive|null $idToken = null ][, array<string, mixed>|null $idClaims = null ]) : mixed
Parameters
- $accessToken : Sensitive
-
The OAuth2 access token (§12.5 secret).
- $tokenType : string
-
The token type the server issued (
Bearer). - $expiresIn : int
-
Access-token lifetime in seconds from the time of the response.
- $scope : string|null = null
-
Granted scope, when the server narrowed or echoed it.
- $refreshToken : Sensitive|null = null
-
The refresh token, when the grant issued one (§12.5 secret).
- $idToken : Sensitive|null = null
-
The raw ID token, when the grant issued one (§12.5 secret).
- $idClaims : array<string, mixed>|null = null
-
The validated ID-token claims — present exactly when
$idTokenis (§12.1, §12.4). Keeps the wire's snake_case claim spelling (iss,sub,aud, …) rather than camelCase, since these are protocol identifiers a caller cross-references against OIDC Core.