v0.39.0
New: JWT-Bearer Grant (RFC 7523)
The oauth_token transform now supports grant: jwt_bearer for RFC 7523 JWT-bearer flows. The proxy mints a JWT signed with an RSA private key sourced from any secrets backend, exchanges it at the token endpoint, and injects the resulting bearer on matching requests. This covers DocuSign, Salesforce, Box, Zoom Server-to-Server, Adobe Sign, and any other vendor that trades a signed JWT assertion for an access token. Token caching, single-flight, fingerprint-based credential rotation, and token_endpoint_headers all apply as with the other grant types.
- name: oauth_token
config:
tokens:
- grant: jwt_bearer
issuer: {type: env, var: DOCUSIGN_INTEGRATION_KEY}
subject: {type: env, var: DOCUSIGN_USER_GUID}
private_key:
type: 1password_connect
secret_ref: "op://Engineering/DOCUSIGN/private-key.pem"
private_key_id: {type: env, var: DOCUSIGN_KEY_ID} # optional; emitted as JWT kid header
audience: "account.docusign.com"
token_endpoint: "https://account.docusign.com/oauth/token"
scopes: ["signature", "impersonation"]
rules:
- host: "*.docusign.net"The same shape works for Salesforce (audience: https://login.salesforce.com, token_endpoint: https://login.salesforce.com/services/oauth2/token), Box, and Zoom S2S. Only audience, token_endpoint, and scopes change. The existing gcp_auth transform remains the convenience wrapper for Google's keyfile format.