#### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index')
### [Abblix\.Oidc\.Server\.Common\.Configuration](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration 'Abblix\.Oidc\.Server\.Common\.Configuration')

## ServiceTokensAlgorithmsValidator Class

Fails loudly at startup when a configured [ServiceTokensOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.ServiceTokensOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.ServiceTokensOptions') names a signing or
key\-management algorithm that no registered signer or encryptor can produce, instead of letting the
contradiction surface at token\-issuance time as a per\-request failure\. The accepted sets are read from
the live JWT registrations, the same union OpenID Connect discovery advertises, so a host that adds or
replaces an algorithm is validated against exactly what it registered \- no static allow\-list to keep in sync\.

```csharp
public sealed class ServiceTokensAlgorithmsValidator : Microsoft.Extensions.Options.IValidateOptions<Abblix.Oidc.Server.Common.Configuration.OidcOptions>
```

Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ServiceTokensAlgorithmsValidator

Implements [Microsoft\.Extensions\.Options\.IValidateOptions&lt;](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ivalidateoptions-1 'Microsoft\.Extensions\.Options\.IValidateOptions\`1')[OidcOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions')[&gt;](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ivalidateoptions-1 'Microsoft\.Extensions\.Options\.IValidateOptions\`1')
### Constructors

## ServiceTokensAlgorithmsValidator\(IJsonWebTokenCreator, IKeyCustodian\) Constructor {#Abblix.Oidc.Server.Common.Configuration.ServiceTokensAlgorithmsValidator.ServiceTokensAlgorithmsValidator(Abblix.Jwt.IJsonWebTokenCreator,Abblix.Jwt.ExternalKeys.IKeyCustodian)}

Fails loudly at startup when a configured [ServiceTokensOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.ServiceTokensOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.ServiceTokensOptions') names a signing or
key\-management algorithm that no registered signer or encryptor can produce, instead of letting the
contradiction surface at token\-issuance time as a per\-request failure\. The accepted sets are read from
the live JWT registrations, the same union OpenID Connect discovery advertises, so a host that adds or
replaces an algorithm is validated against exactly what it registered \- no static allow\-list to keep in sync\.

```csharp
public ServiceTokensAlgorithmsValidator(Abblix.Jwt.IJsonWebTokenCreator jwtCreator, Abblix.Jwt.ExternalKeys.IKeyCustodian? custodian=null);
```
#### Parameters

###### `jwtCreator` [IJsonWebTokenCreator](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.IJsonWebTokenCreator 'Abblix\.Jwt\.IJsonWebTokenCreator') {#Abblix.Oidc.Server.Common.Configuration.ServiceTokensAlgorithmsValidator.ServiceTokensAlgorithmsValidator(Abblix.Jwt.IJsonWebTokenCreator,Abblix.Jwt.ExternalKeys.IKeyCustodian).jwtCreator}

Source of the registered signing and JWE key\-management algorithms\. Kept
            lightweight on purpose, so validating options does not drag the runtime token pipeline \(and its storage\)
            into startup\.

###### `custodian` [IKeyCustodian](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.IKeyCustodian 'Abblix\.Jwt\.ExternalKeys\.IKeyCustodian') {#Abblix.Oidc.Server.Common.Configuration.ServiceTokensAlgorithmsValidator.ServiceTokensAlgorithmsValidator(Abblix.Jwt.IJsonWebTokenCreator,Abblix.Jwt.ExternalKeys.IKeyCustodian).custodian}

Present when the host holds its keys in an external custodian \(a Vault or Key Vault
            backend\), absent when they come from [EncryptionKeys](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions#Abblix.Oidc.Server.Common.Configuration.OidcOptions.EncryptionKeys 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions\.EncryptionKeys')\. It is a registration marker
            only, and is never called here: it answers where the keys come from without reading them, and without
            reading the options that are still being created\. Injecting the key provider instead would re\-enter
            [Microsoft\.Extensions\.Options\.IOptions&lt;&gt;\.Value](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptions-1.value 'Microsoft\.Extensions\.Options\.IOptions\`1\.Value') from inside its own creation\.