[Piyush-85]

Summary

• Adds dpopKeyPair?: CryptoKeyPair to RequestOptions - an optional, additive field; all callers without it are unchanged
• Adds a private #dpopOption(config, requestOptions) helper to AuthClient and MfaClient that builds an openid-client DPoPHandle against the exact configuration used for the call (capture configs included), returning {} when no key pair is supplied
• Threads the DPoP option into every grant call site: authorizationCodeGrant, refreshTokenGrant, genericGrantRequest (passkey, passwordless, CIBA, token-vault/connection exchange, token exchange, MFA verify), and pollBackchannelAuthenticationGrant — 10 call sites total across auth-client.ts and mfa/mfa-client.ts
• Proof generation and the use_dpop_nonce retry are handled entirely by openid-client — no new crypto code in this repo
• Authorize-side dpop_jkt is already covered: consumers can pass it via authorizationParams today; no engine change needed

Test plan

• DPoP (RFC 9449) describe in auth-client.spec.ts: proof header present when key pair supplied, absent when not, key reused across successive refreshes
• DPoP (RFC 9449) describe in mfa/mfa-client.spec.ts: proof header present when key pair supplied, absent when not
• npm test — 578 pass, 0 fail

[coderabbitai]

Warning

Review limit reached

Next included review available in 50 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 73b379b1-7384-47cd-8794-45f29e1a6635

📥 Commits

Reviewing files that changed from the base of the PR and between e8de286 and 6833a99.

📒 Files selected for processing (5)

• packages/auth0-auth-js/src/auth-client.spec.ts
• packages/auth0-auth-js/src/auth-client.ts
• packages/auth0-auth-js/src/mfa/mfa-client.spec.ts
• packages/auth0-auth-js/src/mfa/mfa-client.ts
• packages/auth0-auth-js/src/types.ts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}