#### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index')
### [Abblix\.Oidc\.Server\.Features\.Tokens\.Formatters](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.Formatters 'Abblix\.Oidc\.Server\.Features\.Tokens\.Formatters')

## ClientJwtEncryption Class

The encryption policy a caller hands to [ClientJwtFormatter](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.Formatters.ClientJwtFormatter 'Abblix\.Oidc\.Server\.Features\.Tokens\.Formatters\.ClientJwtFormatter') when formatting a client\-addressed JWT\.
It makes explicit which registered client metadata governs encryption, so the formatter no longer has to infer it
from the token type\. Each client\-JWT class \(UserInfo, ID token, JARM authorization response, introspection\)
supplies its own policy via the static factories below\.

```csharp
public sealed record ClientJwtEncryption : System.IEquatable<Abblix.Oidc.Server.Features.Tokens.Formatters.ClientJwtEncryption>
```

Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ClientJwtEncryption

Implements [System\.IEquatable&lt;](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[ClientJwtEncryption](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.Formatters.ClientJwtEncryption 'Abblix\.Oidc\.Server\.Features\.Tokens\.Formatters\.ClientJwtEncryption')[&gt;](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')
### Constructors

## ClientJwtEncryption\(string, string, string, bool\) Constructor {#Abblix.Oidc.Server.Features.Tokens.Formatters.ClientJwtEncryption.ClientJwtEncryption(string,string,string,bool)}

The encryption policy a caller hands to [ClientJwtFormatter](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.Formatters.ClientJwtFormatter 'Abblix\.Oidc\.Server\.Features\.Tokens\.Formatters\.ClientJwtFormatter') when formatting a client\-addressed JWT\.
It makes explicit which registered client metadata governs encryption, so the formatter no longer has to infer it
from the token type\. Each client\-JWT class \(UserInfo, ID token, JARM authorization response, introspection\)
supplies its own policy via the static factories below\.

```csharp
public ClientJwtEncryption(string? KeyManagementAlgorithm, string? ContentEncryptionAlgorithm, string DefaultContentEncryptionAlgorithm, bool RequireRegisteredAlgorithm);
```
#### Parameters

###### `KeyManagementAlgorithm` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.Tokens.Formatters.ClientJwtEncryption.ClientJwtEncryption(string,string,string,bool).KeyManagementAlgorithm}

The client's registered `*_encrypted_response_alg`, or `null` when
            the client did not register one\.

###### `ContentEncryptionAlgorithm` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.Tokens.Formatters.ClientJwtEncryption.ClientJwtEncryption(string,string,string,bool).ContentEncryptionAlgorithm}

The client's registered `*_encrypted_response_enc`, or `null`
            to fall back to [DefaultContentEncryptionAlgorithm](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.Formatters.ClientJwtEncryption#Abblix.Oidc.Server.Features.Tokens.Formatters.ClientJwtEncryption.DefaultContentEncryptionAlgorithm 'Abblix\.Oidc\.Server\.Features\.Tokens\.Formatters\.ClientJwtEncryption\.DefaultContentEncryptionAlgorithm')\.

###### `DefaultContentEncryptionAlgorithm` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.Tokens.Formatters.ClientJwtEncryption.ClientJwtEncryption(string,string,string,bool).DefaultContentEncryptionAlgorithm}

The content\-encryption algorithm to use when the client did not
            register one\.

###### `RequireRegisteredAlgorithm` [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') {#Abblix.Oidc.Server.Features.Tokens.Formatters.ClientJwtEncryption.ClientJwtEncryption(string,string,string,bool).RequireRegisteredAlgorithm}

When `true` the JWT is encrypted only if the client registered a
            key\-management algorithm \(and the client's encryption keys are not even resolved otherwise\) — the JARM §2\.2 / §3
            opt\-in rule\. When `false` the JWT is encrypted whenever the client published encryption keys\.
### Properties

## ClientJwtEncryption\.ContentEncryptionAlgorithm Property {#Abblix.Oidc.Server.Features.Tokens.Formatters.ClientJwtEncryption.ContentEncryptionAlgorithm}

The client's registered `*_encrypted_response_enc`, or `null`
            to fall back to [DefaultContentEncryptionAlgorithm](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.Formatters.ClientJwtEncryption#Abblix.Oidc.Server.Features.Tokens.Formatters.ClientJwtEncryption.DefaultContentEncryptionAlgorithm 'Abblix\.Oidc\.Server\.Features\.Tokens\.Formatters\.ClientJwtEncryption\.DefaultContentEncryptionAlgorithm')\.

```csharp
public string? ContentEncryptionAlgorithm { get; init; }
```

#### Property Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## ClientJwtEncryption\.DefaultContentEncryptionAlgorithm Property {#Abblix.Oidc.Server.Features.Tokens.Formatters.ClientJwtEncryption.DefaultContentEncryptionAlgorithm}

The content\-encryption algorithm to use when the client did not
            register one\.

```csharp
public string DefaultContentEncryptionAlgorithm { get; init; }
```

#### Property Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## ClientJwtEncryption\.KeyManagementAlgorithm Property {#Abblix.Oidc.Server.Features.Tokens.Formatters.ClientJwtEncryption.KeyManagementAlgorithm}

The client's registered `*_encrypted_response_alg`, or `null` when
            the client did not register one\.

```csharp
public string? KeyManagementAlgorithm { get; init; }
```

#### Property Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## ClientJwtEncryption\.RequireRegisteredAlgorithm Property {#Abblix.Oidc.Server.Features.Tokens.Formatters.ClientJwtEncryption.RequireRegisteredAlgorithm}

When `true` the JWT is encrypted only if the client registered a
            key\-management algorithm \(and the client's encryption keys are not even resolved otherwise\) — the JARM §2\.2 / §3
            opt\-in rule\. When `false` the JWT is encrypted whenever the client published encryption keys\.

```csharp
public bool RequireRegisteredAlgorithm { get; init; }
```

#### Property Value
[System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean')
### Methods

## ClientJwtEncryption\.ForIdentityToken\(ClientInfo, OidcOptions\) Method {#Abblix.Oidc.Server.Features.Tokens.Formatters.ClientJwtEncryption.ForIdentityToken(Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,Abblix.Oidc.Server.Common.Configuration.OidcOptions)}

Policy for an ID token or logout token: encrypts whenever the client published encryption keys, using its
`id_token_encrypted_response_*` metadata\.

```csharp
public static Abblix.Oidc.Server.Features.Tokens.Formatters.ClientJwtEncryption ForIdentityToken(Abblix.Oidc.Server.Features.ClientInformation.ClientInfo clientInfo, Abblix.Oidc.Server.Common.Configuration.OidcOptions options);
```
#### Parameters

###### `clientInfo` [ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo') {#Abblix.Oidc.Server.Features.Tokens.Formatters.ClientJwtEncryption.ForIdentityToken(Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,Abblix.Oidc.Server.Common.Configuration.OidcOptions).clientInfo}

###### `options` [OidcOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions') {#Abblix.Oidc.Server.Features.Tokens.Formatters.ClientJwtEncryption.ForIdentityToken(Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,Abblix.Oidc.Server.Common.Configuration.OidcOptions).options}

#### Returns
[ClientJwtEncryption](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.Formatters.ClientJwtEncryption 'Abblix\.Oidc\.Server\.Features\.Tokens\.Formatters\.ClientJwtEncryption')

## ClientJwtEncryption\.ForIntrospection\(ClientInfo, OidcOptions\) Method {#Abblix.Oidc.Server.Features.Tokens.Formatters.ClientJwtEncryption.ForIntrospection(Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,Abblix.Oidc.Server.Common.Configuration.OidcOptions)}

Policy for a signed/encrypted token introspection response \(RFC 9701\): encrypts whenever the client published
encryption keys, using its `introspection_encrypted_response_*` metadata\.

```csharp
public static Abblix.Oidc.Server.Features.Tokens.Formatters.ClientJwtEncryption ForIntrospection(Abblix.Oidc.Server.Features.ClientInformation.ClientInfo clientInfo, Abblix.Oidc.Server.Common.Configuration.OidcOptions options);
```
#### Parameters

###### `clientInfo` [ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo') {#Abblix.Oidc.Server.Features.Tokens.Formatters.ClientJwtEncryption.ForIntrospection(Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,Abblix.Oidc.Server.Common.Configuration.OidcOptions).clientInfo}

###### `options` [OidcOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions') {#Abblix.Oidc.Server.Features.Tokens.Formatters.ClientJwtEncryption.ForIntrospection(Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,Abblix.Oidc.Server.Common.Configuration.OidcOptions).options}

#### Returns
[ClientJwtEncryption](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.Formatters.ClientJwtEncryption 'Abblix\.Oidc\.Server\.Features\.Tokens\.Formatters\.ClientJwtEncryption')

## ClientJwtEncryption\.ForJarm\(ClientInfo\) Method {#Abblix.Oidc.Server.Features.Tokens.Formatters.ClientJwtEncryption.ForJarm(Abblix.Oidc.Server.Features.ClientInformation.ClientInfo)}

Policy for a JARM authorization response JWT: encrypts only when the client registered
`authorization_encrypted_response_alg` \(JARM §2\.2 / §3 opt\-in\), defaulting the content\-encryption to
`A128CBC-HS256` when `authorization_encrypted_response_enc` is omitted \(JARM §3\)\.

```csharp
public static Abblix.Oidc.Server.Features.Tokens.Formatters.ClientJwtEncryption ForJarm(Abblix.Oidc.Server.Features.ClientInformation.ClientInfo clientInfo);
```
#### Parameters

###### `clientInfo` [ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo') {#Abblix.Oidc.Server.Features.Tokens.Formatters.ClientJwtEncryption.ForJarm(Abblix.Oidc.Server.Features.ClientInformation.ClientInfo).clientInfo}

#### Returns
[ClientJwtEncryption](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.Formatters.ClientJwtEncryption 'Abblix\.Oidc\.Server\.Features\.Tokens\.Formatters\.ClientJwtEncryption')

## ClientJwtEncryption\.ForUserInfo\(ClientInfo, OidcOptions\) Method {#Abblix.Oidc.Server.Features.Tokens.Formatters.ClientJwtEncryption.ForUserInfo(Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,Abblix.Oidc.Server.Common.Configuration.OidcOptions)}

Policy for a signed/encrypted UserInfo response \(OIDC Core §5\.3\.2\): encrypts whenever the client published
encryption keys, using its `userinfo_encrypted_response_*` metadata\.

```csharp
public static Abblix.Oidc.Server.Features.Tokens.Formatters.ClientJwtEncryption ForUserInfo(Abblix.Oidc.Server.Features.ClientInformation.ClientInfo clientInfo, Abblix.Oidc.Server.Common.Configuration.OidcOptions options);
```
#### Parameters

###### `clientInfo` [ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo') {#Abblix.Oidc.Server.Features.Tokens.Formatters.ClientJwtEncryption.ForUserInfo(Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,Abblix.Oidc.Server.Common.Configuration.OidcOptions).clientInfo}

###### `options` [OidcOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions') {#Abblix.Oidc.Server.Features.Tokens.Formatters.ClientJwtEncryption.ForUserInfo(Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,Abblix.Oidc.Server.Common.Configuration.OidcOptions).options}

#### Returns
[ClientJwtEncryption](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.Formatters.ClientJwtEncryption 'Abblix\.Oidc\.Server\.Features\.Tokens\.Formatters\.ClientJwtEncryption')