Interface TokenCredential

All Known Implementing Classes:
ApiKey, BearerToken, OidcAccessToken, RefreshToken
@ExperimentalJSentinelApi("V00.74 token propagation; stable promotion staged for V00.76") public sealed interface TokenCredential permits BearerToken, OidcAccessToken, RefreshToken, ApiKey
Sealed type for inbound / outbound tokens flowing through the V00.74 token-propagation pipeline.

Four permits cover the realistic shapes:

  • BearerToken — opaque bearer token carried in Authorization: Bearer ….
  • OidcAccessToken — OIDC access token, semantically a bearer with an issuer claim.
  • RefreshToken — class-A refresh secret; never forwarded by PassThroughStrategy.
  • ApiKey — opaque API key; transport-specific header handling (consumers register their own strategy).

Logging discipline. value() returns the raw token. It must never be:

  • written to any logger,
  • recorded in any AuditEvent,
  • persisted to any store outside the TokenCredentialStore contract.
Every record implementation masks the value in toString() (e.g. "BearerToken{exp=…, aud=…, value=***}").

V00.74 ships this type tagged ExperimentalJSentinelApi; stable-API promotion is staged for V00.76 after at least one demo migration cycle.

Since:
00.74.00

  • Method Details

    • value

      String value()
      The raw token string.

      Never log, never audit, never persist outside the TokenCredentialStore. Treated as a Class-A secret.

      Returns:
      the raw token value (non-null, non-empty by construction)

    • expiresAt

      Optional<Instant> expiresAt()
      Returns:
      wall-clock expiry of the token, if known

    • audience

      Optional<String> audience()
      Returns:
      declared audience of the token, if known

    • issuerHash

      Optional<String> issuerHash()
      Returns:
      SHA-256 hex of the issuer (e.g. issuer URL), for audit metadata only — never the issuer URL itself in clear text