Why Go
- Case Studies
  
  Common problems companies solve with Go
- Use Cases
  
  Stories about how and why companies use Go
- Security
  
  How Go can help keep you secure by default
Learn
Docs
- Effective Go
  
  Tips for writing clear, performant, and idiomatic Go code
- Go User Manual
  
  A complete introduction to building software with Go
- Standard library
  
  Reference documentation for Go's standard library
- Release Notes
  
  Learn what's new in each Go release
- API
  
  Reference documentation for the pkg.go.dev API
Packages
Community
- Recorded Talks
  
  Videos from prior events
- Meetups
  
  Meet other local Go developers
- Conferences
  
  Learn and network with Go developers from around the world
- Go blog
  
  The Go project's official blog.
- Go project
  
  Get help and stay informed from Go
- Get connected

tokenexchange

package

Go to main page

Versions in this module

v0

v0.44.0

Aug 18, 2026

Changes in this version

type TrustedIssuer

+ AllowMayAct bool

v0.43.0

Aug 14, 2026

v0.42.1

Aug 10, 2026

Changes in this version

+ func ValidateJWKSURL(jwksURL string, insecureAllowHTTP, allowPrivateIPs bool) error

+ func ValidateTrustedIssuers(trustedIssuers []TrustedIssuer, selfIssuer string) error

type MayActClaim

+ Iss string

type TrustedIssuer

+ ActorClaim string

+ AllowPrivateIPs bool

+ AllowedActors []string

+ AllowedDelegateClients []string

+ InsecureAllowHTTP bool

type ValidatedClaims

+ AllowedDelegateClients []string

+ ExternalActor string

+ ExternalIssuer string

v0.42.0

Aug 5, 2026

v0.41.0

Jul 28, 2026

Changes in this version

+ type MultiIssuerTokenValidator struct

+ func NewMultiIssuerTokenValidator(selfValidator *SelfIssuedTokenValidator, selfIssuer string, ...) (*MultiIssuerTokenValidator, error)

+ func (v *MultiIssuerTokenValidator) Validate(ctx context.Context, rawToken string) (*ValidatedClaims, error)

+ type SelfIssuedTokenValidator struct

+ func NewSelfIssuedTokenValidator(jwks *jose.JSONWebKeySet, issuer string, allowedAudiences []string) (*SelfIssuedTokenValidator, error)

+ func (v *SelfIssuedTokenValidator) Validate(_ context.Context, rawToken string) (*ValidatedClaims, error)

+ type TrustedIssuer struct

+ ExpectedAudience string

+ IssuerURL string

+ JWKSURL string

v0.40.1

Jul 20, 2026

v0.40.0

Jul 17, 2026

Changes in this version

+ func Factory(delegationLifespan time.Duration) (server.Factory, error)

+ type Handler struct

+ func (*Handler) CanHandleTokenEndpointRequest(_ context.Context, requester fosite.AccessRequester) bool

+ func (*Handler) CanSkipClientAuth(_ context.Context, _ fosite.AccessRequester) bool

+ func (h *Handler) HandleTokenEndpointRequest(ctx context.Context, requester fosite.AccessRequester) error

+ func (h *Handler) PopulateTokenEndpointResponse(ctx context.Context, requester fosite.AccessRequester, ...) error

+ type MayActClaim struct

+ Sub string

+ type SubjectTokenValidator struct

+ func NewSubjectTokenValidator(jwks *jose.JSONWebKeySet, issuer string, allowedAudiences []string) (*SubjectTokenValidator, error)

+ func (v *SubjectTokenValidator) Validate(_ context.Context, rawToken string) (*ValidatedClaims, error)

+ type ValidatedClaims struct

+ Audience []string

+ ClientID string

+ Email string

+ Expiry time.Time

+ Extra map[string]any

+ IssuedAt time.Time

+ Issuer string

+ JWTID string

+ MayAct *MayActClaim

+ Name string

+ Scopes string

+ Subject string