#### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index')
### [Abblix\.Oidc\.Server\.Features\.Tokens\.Formatters](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.Formatters 'Abblix\.Oidc\.Server\.Features\.Tokens\.Formatters')

## ServiceJwtEncryption Class

The encryption policy a caller hands to [AuthServiceJwtFormatter](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.Formatters.AuthServiceJwtFormatter 'Abblix\.Oidc\.Server\.Features\.Tokens\.Formatters\.AuthServiceJwtFormatter') when formatting a JWT the
server issues for itself\. It is the service\-side mirror of [ClientJwtEncryption](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.Formatters.ClientJwtEncryption 'Abblix\.Oidc\.Server\.Features\.Tokens\.Formatters\.ClientJwtEncryption'): it makes
explicit whether the token is encrypted and, if so, to which of the server's own keys and with which
algorithms, so the formatter no longer encrypts implicitly whenever any encryption key happens to exist\.
Each service\-token type supplies its own policy via the static factories below, projected from
[ServiceTokens](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions#Abblix.Oidc.Server.Common.Configuration.OidcOptions.ServiceTokens 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions\.ServiceTokens')\.

```csharp
public sealed record ServiceJwtEncryption : System.IEquatable<Abblix.Oidc.Server.Features.Tokens.Formatters.ServiceJwtEncryption>
```

Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ServiceJwtEncryption

Implements [System\.IEquatable&lt;](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[ServiceJwtEncryption](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.Formatters.ServiceJwtEncryption 'Abblix\.Oidc\.Server\.Features\.Tokens\.Formatters\.ServiceJwtEncryption')[&gt;](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')
### Constructors

## ServiceJwtEncryption\(Nullable\<bool\>, string, string, string\) Constructor {#Abblix.Oidc.Server.Features.Tokens.Formatters.ServiceJwtEncryption.ServiceJwtEncryption(System.Nullable_bool_,string,string,string)}

The encryption policy a caller hands to [AuthServiceJwtFormatter](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.Formatters.AuthServiceJwtFormatter 'Abblix\.Oidc\.Server\.Features\.Tokens\.Formatters\.AuthServiceJwtFormatter') when formatting a JWT the
server issues for itself\. It is the service\-side mirror of [ClientJwtEncryption](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.Formatters.ClientJwtEncryption 'Abblix\.Oidc\.Server\.Features\.Tokens\.Formatters\.ClientJwtEncryption'): it makes
explicit whether the token is encrypted and, if so, to which of the server's own keys and with which
algorithms, so the formatter no longer encrypts implicitly whenever any encryption key happens to exist\.
Each service\-token type supplies its own policy via the static factories below, projected from
[ServiceTokens](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions#Abblix.Oidc.Server.Common.Configuration.OidcOptions.ServiceTokens 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions\.ServiceTokens')\.

```csharp
public ServiceJwtEncryption(System.Nullable<bool> Encrypt, string? KeyManagementAlgorithm, string? KeyId, string ContentEncryptionAlgorithm);
```
#### Parameters

###### `Encrypt` [System\.Nullable&lt;](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean')[&gt;](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1') {#Abblix.Oidc.Server.Features.Tokens.Formatters.ServiceJwtEncryption.ServiceJwtEncryption(System.Nullable_bool_,string,string,string).Encrypt}

Whether to encrypt the token\. `false` yields a signed\-only JWS and the
            server's encryption keys are not even resolved\. `true` requires encryption and fails when no key can
            be resolved\. `null` states nothing: encrypt if a key is available, sign only if not\.

###### `KeyManagementAlgorithm` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.Tokens.Formatters.ServiceJwtEncryption.ServiceJwtEncryption(System.Nullable_bool_,string,string,string).KeyManagementAlgorithm}

The JWE key\-management `alg`, or `null` to derive it from
            the selected encryption key's declared `alg` \(RFC 7517 Section 4\.4\), falling back to
            `RSA-OAEP-256`\.

###### `KeyId` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.Tokens.Formatters.ServiceJwtEncryption.ServiceJwtEncryption(System.Nullable_bool_,string,string,string).KeyId}

The `kid` of the encryption key to select, or `null` to take the first
            configured encryption key\.

###### `ContentEncryptionAlgorithm` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.Tokens.Formatters.ServiceJwtEncryption.ServiceJwtEncryption(System.Nullable_bool_,string,string,string).ContentEncryptionAlgorithm}

The JWE content\-encryption `enc`, taken from
            [DefaultContentEncryptionAlgorithm](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions#Abblix.Oidc.Server.Common.Configuration.OidcOptions.DefaultContentEncryptionAlgorithm 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions\.DefaultContentEncryptionAlgorithm')\.
### Properties

## ServiceJwtEncryption\.ContentEncryptionAlgorithm Property {#Abblix.Oidc.Server.Features.Tokens.Formatters.ServiceJwtEncryption.ContentEncryptionAlgorithm}

The JWE content\-encryption `enc`, taken from
            [DefaultContentEncryptionAlgorithm](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions#Abblix.Oidc.Server.Common.Configuration.OidcOptions.DefaultContentEncryptionAlgorithm 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions\.DefaultContentEncryptionAlgorithm')\.

```csharp
public string ContentEncryptionAlgorithm { get; init; }
```

#### Property Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## ServiceJwtEncryption\.Encrypt Property {#Abblix.Oidc.Server.Features.Tokens.Formatters.ServiceJwtEncryption.Encrypt}

Whether to encrypt the token\. `false` yields a signed\-only JWS and the
            server's encryption keys are not even resolved\. `true` requires encryption and fails when no key can
            be resolved\. `null` states nothing: encrypt if a key is available, sign only if not\.

```csharp
public System.Nullable<bool> Encrypt { get; init; }
```

#### Property Value
[System\.Nullable&lt;](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean')[&gt;](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')

## ServiceJwtEncryption\.Key Property {#Abblix.Oidc.Server.Features.Tokens.Formatters.ServiceJwtEncryption.Key}

The key to encrypt to, when it is not one of this server's own\. Set for an access token whose named
audience publishes a key: the token is then readable by the party it was minted for, instead of only by
this server\.

```csharp
public Abblix.Jwt.JsonWebKey? Key { get; init; }
```

#### Property Value
[JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey')

### Remarks
Carried as data rather than resolved by the formatter, so the formatter stays unaware of resources and
the decision is made where the request context is\. When null the server's own encryption keys are
selected as before\.

## ServiceJwtEncryption\.KeyId Property {#Abblix.Oidc.Server.Features.Tokens.Formatters.ServiceJwtEncryption.KeyId}

The `kid` of the encryption key to select, or `null` to take the first
            configured encryption key\.

```csharp
public string? KeyId { get; init; }
```

#### Property Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## ServiceJwtEncryption\.KeyManagementAlgorithm Property {#Abblix.Oidc.Server.Features.Tokens.Formatters.ServiceJwtEncryption.KeyManagementAlgorithm}

The JWE key\-management `alg`, or `null` to derive it from
            the selected encryption key's declared `alg` \(RFC 7517 Section 4\.4\), falling back to
            `RSA-OAEP-256`\.

```csharp
public string? KeyManagementAlgorithm { get; init; }
```

#### Property Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')
### Methods

## ServiceJwtEncryption\.ForAccessToken\(OidcOptions\) Method {#Abblix.Oidc.Server.Features.Tokens.Formatters.ServiceJwtEncryption.ForAccessToken(Abblix.Oidc.Server.Common.Configuration.OidcOptions)}

Policy for the access token, projected from `ServiceTokens.AccessToken`\.

```csharp
public static Abblix.Oidc.Server.Features.Tokens.Formatters.ServiceJwtEncryption ForAccessToken(Abblix.Oidc.Server.Common.Configuration.OidcOptions options);
```
#### Parameters

###### `options` [OidcOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions') {#Abblix.Oidc.Server.Features.Tokens.Formatters.ServiceJwtEncryption.ForAccessToken(Abblix.Oidc.Server.Common.Configuration.OidcOptions).options}

#### Returns
[ServiceJwtEncryption](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.Formatters.ServiceJwtEncryption 'Abblix\.Oidc\.Server\.Features\.Tokens\.Formatters\.ServiceJwtEncryption')

## ServiceJwtEncryption\.ForInitialAccessToken\(OidcOptions\) Method {#Abblix.Oidc.Server.Features.Tokens.Formatters.ServiceJwtEncryption.ForInitialAccessToken(Abblix.Oidc.Server.Common.Configuration.OidcOptions)}

Policy for the initial access token, projected from `ServiceTokens.InitialAccessToken`\.

```csharp
public static Abblix.Oidc.Server.Features.Tokens.Formatters.ServiceJwtEncryption ForInitialAccessToken(Abblix.Oidc.Server.Common.Configuration.OidcOptions options);
```
#### Parameters

###### `options` [OidcOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions') {#Abblix.Oidc.Server.Features.Tokens.Formatters.ServiceJwtEncryption.ForInitialAccessToken(Abblix.Oidc.Server.Common.Configuration.OidcOptions).options}

#### Returns
[ServiceJwtEncryption](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.Formatters.ServiceJwtEncryption 'Abblix\.Oidc\.Server\.Features\.Tokens\.Formatters\.ServiceJwtEncryption')

## ServiceJwtEncryption\.ForRefreshToken\(OidcOptions\) Method {#Abblix.Oidc.Server.Features.Tokens.Formatters.ServiceJwtEncryption.ForRefreshToken(Abblix.Oidc.Server.Common.Configuration.OidcOptions)}

Policy for the refresh token, projected from `ServiceTokens.RefreshToken`\.

```csharp
public static Abblix.Oidc.Server.Features.Tokens.Formatters.ServiceJwtEncryption ForRefreshToken(Abblix.Oidc.Server.Common.Configuration.OidcOptions options);
```
#### Parameters

###### `options` [OidcOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions') {#Abblix.Oidc.Server.Features.Tokens.Formatters.ServiceJwtEncryption.ForRefreshToken(Abblix.Oidc.Server.Common.Configuration.OidcOptions).options}

#### Returns
[ServiceJwtEncryption](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.Formatters.ServiceJwtEncryption 'Abblix\.Oidc\.Server\.Features\.Tokens\.Formatters\.ServiceJwtEncryption')

## ServiceJwtEncryption\.ForRegistrationAccessToken\(OidcOptions\) Method {#Abblix.Oidc.Server.Features.Tokens.Formatters.ServiceJwtEncryption.ForRegistrationAccessToken(Abblix.Oidc.Server.Common.Configuration.OidcOptions)}

Policy for the registration access token, projected from `ServiceTokens.RegistrationAccessToken`\.

```csharp
public static Abblix.Oidc.Server.Features.Tokens.Formatters.ServiceJwtEncryption ForRegistrationAccessToken(Abblix.Oidc.Server.Common.Configuration.OidcOptions options);
```
#### Parameters

###### `options` [OidcOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions') {#Abblix.Oidc.Server.Features.Tokens.Formatters.ServiceJwtEncryption.ForRegistrationAccessToken(Abblix.Oidc.Server.Common.Configuration.OidcOptions).options}

#### Returns
[ServiceJwtEncryption](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.Formatters.ServiceJwtEncryption 'Abblix\.Oidc\.Server\.Features\.Tokens\.Formatters\.ServiceJwtEncryption')