#### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index')
### [Abblix\.Oidc\.Server\.Common\.Configuration](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration 'Abblix\.Oidc\.Server\.Common\.Configuration')

## ServiceTokenOptions Class

The signing and encryption settings for one type of JWT the authorization server issues for itself
\(access, refresh, registration access or initial access token\)\. The same shape is reused for every type
via [ServiceTokensOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.ServiceTokensOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.ServiceTokensOptions')\.

```csharp
public record ServiceTokenOptions : System.IEquatable<Abblix.Oidc.Server.Common.Configuration.ServiceTokenOptions>
```

Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ServiceTokenOptions

Implements [System\.IEquatable&lt;](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[ServiceTokenOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.ServiceTokenOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.ServiceTokenOptions')[&gt;](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')
### Properties

## ServiceTokenOptions\.Encrypt Property {#Abblix.Oidc.Server.Common.Configuration.ServiceTokenOptions.Encrypt}

Whether to encrypt this token type to the server's own encryption key\.

```csharp
public System.Nullable<bool> Encrypt { get; set; }
```

#### Property Value
[System\.Nullable&lt;](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean')[&gt;](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')

### Remarks
Three states, and the difference between two of them decides how a missing key is answered:
- `false` keeps the token a signed JWS even when an encryption key exists, for example to keep
              the access token readable by external resource servers that validate it against the published key set.
              The server's encryption keys are not resolved at all.
- `true` requires encryption. If no encryption key can be resolved the server refuses to issue
              the token rather than falling back to a signed JWS, because a host that asked for confidentiality and
              silently did not get it has no way to find out.
- `null`, the default, states nothing: the token is encrypted when a server encryption key is
              available and signed only when none is, which is the behaviour of prior versions. A host that never
              touched this setting therefore sees no change and no new failure.

## ServiceTokenOptions\.Encryption Property {#Abblix.Oidc.Server.Common.Configuration.ServiceTokenOptions.Encryption}

How this token type is encrypted when [Encrypt](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.ServiceTokenOptions#Abblix.Oidc.Server.Common.Configuration.ServiceTokenOptions.Encrypt 'Abblix\.Oidc\.Server\.Common\.Configuration\.ServiceTokenOptions\.Encrypt') is on and a server encryption key is
available: the JWE key\-management algorithm and the key to use\. Left at its defaults it derives the
algorithm from the selected key and takes the first configured encryption key\.

```csharp
public Abblix.Oidc.Server.Common.Configuration.JwtEncryptionSettings Encryption { get; set; }
```

#### Property Value
[JwtEncryptionSettings](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.JwtEncryptionSettings 'Abblix\.Oidc\.Server\.Common\.Configuration\.JwtEncryptionSettings')

## ServiceTokenOptions\.Signing Property {#Abblix.Oidc.Server.Common.Configuration.ServiceTokenOptions.Signing}

The signing settings, always present\. Left at its defaults it signs with RS256 and lets the server
choose the first matching key, reproducing the output the server produced before this option existed\.

```csharp
public Abblix.Oidc.Server.Common.Configuration.JwtSigningSettings Signing { get; set; }
```

#### Property Value
[JwtSigningSettings](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.JwtSigningSettings 'Abblix\.Oidc\.Server\.Common\.Configuration\.JwtSigningSettings')