@clerk/backend 3.0.0-snapshot.v20251204143242 → 3.0.0-snapshot.v20251208202852

package/dist/errors.d.ts

@@ -46,16 +46,19 @@ export declare const MachineTokenVerificationErrorCode: {
     readonly TokenInvalid: "token-invalid";
     readonly InvalidSecretKey: "secret-key-invalid";
     readonly UnexpectedError: "unexpected-error";
+    readonly TokenVerificationFailed: "token-verification-failed";
 };
 export type MachineTokenVerificationErrorCode = (typeof MachineTokenVerificationErrorCode)[keyof typeof MachineTokenVerificationErrorCode];
 export declare class MachineTokenVerificationError extends Error {
     code: MachineTokenVerificationErrorCode;
     long_message?: string;
-    status: number;
-    constructor({ message, code, status }: {
+    status?: number;
+    action?: TokenVerificationErrorAction;
+    constructor({ message, code, status, action, }: {
         message: string;
         code: MachineTokenVerificationErrorCode;
-        status: number;
+        status?: number;
+        action?: TokenVerificationErrorAction;
     });
     getFullMessage(): string;
 }

package/dist/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAE/C,eAAO,MAAM,0BAA0B;;CAEtC,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG,CAAC,OAAO,0BAA0B,CAAC,CAAC,MAAM,OAAO,0BAA0B,CAAC,CAAC;AAEtH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;CAgBxC,CAAC;AAEF,MAAM,MAAM,4BAA4B,GACtC,CAAC,OAAO,4BAA4B,CAAC,CAAC,MAAM,OAAO,4BAA4B,CAAC,CAAC;AAEnF,eAAO,MAAM,4BAA4B;;;;;;CAMxC,CAAC;AAEF,MAAM,MAAM,4BAA4B,GACtC,CAAC,OAAO,4BAA4B,CAAC,CAAC,MAAM,OAAO,4BAA4B,CAAC,CAAC;AAEnF,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,MAAM,CAAC,EAAE,4BAA4B,CAAC;IACtC,MAAM,EAAE,4BAA4B,CAAC;IACrC,YAAY,CAAC,EAAE,YAAY,CAAC;gBAEhB,EACV,MAAM,EACN,OAAO,EACP,MAAM,GACP,EAAE;QACD,MAAM,CAAC,EAAE,4BAA4B,CAAC;QACtC,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,4BAA4B,CAAC;KACtC;IAUM,cAAc;CAKtB;AAED,qBAAa,YAAa,SAAQ,KAAK;CAAG;AAE1C,eAAO,MAAM,iCAAiC;;;;CAIpC,CAAC;AAEX,MAAM,MAAM,iCAAiC,GAC3C,CAAC,OAAO,iCAAiC,CAAC,CAAC,MAAM,OAAO,iCAAiC,CAAC,CAAC;AAE7F,qBAAa,6BAA8B,SAAQ,KAAK;IACtD,IAAI,EAAE,iCAAiC,CAAC;IACxC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;gBAEH,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,iCAAiC,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE;IAQ5G,cAAc;CAGtB"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAE/C,eAAO,MAAM,0BAA0B;;CAEtC,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG,CAAC,OAAO,0BAA0B,CAAC,CAAC,MAAM,OAAO,0BAA0B,CAAC,CAAC;AAEtH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;CAgBxC,CAAC;AAEF,MAAM,MAAM,4BAA4B,GACtC,CAAC,OAAO,4BAA4B,CAAC,CAAC,MAAM,OAAO,4BAA4B,CAAC,CAAC;AAEnF,eAAO,MAAM,4BAA4B;;;;;;CAMxC,CAAC;AAEF,MAAM,MAAM,4BAA4B,GACtC,CAAC,OAAO,4BAA4B,CAAC,CAAC,MAAM,OAAO,4BAA4B,CAAC,CAAC;AAEnF,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,MAAM,CAAC,EAAE,4BAA4B,CAAC;IACtC,MAAM,EAAE,4BAA4B,CAAC;IACrC,YAAY,CAAC,EAAE,YAAY,CAAC;gBAEhB,EACV,MAAM,EACN,OAAO,EACP,MAAM,GACP,EAAE;QACD,MAAM,CAAC,EAAE,4BAA4B,CAAC;QACtC,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,4BAA4B,CAAC;KACtC;IAUM,cAAc;CAKtB;AAED,qBAAa,YAAa,SAAQ,KAAK;CAAG;AAE1C,eAAO,MAAM,iCAAiC;;;;;CAKpC,CAAC;AAEX,MAAM,MAAM,iCAAiC,GAC3C,CAAC,OAAO,iCAAiC,CAAC,CAAC,MAAM,OAAO,iCAAiC,CAAC,CAAC;AAE7F,qBAAa,6BAA8B,SAAQ,KAAK;IACtD,IAAI,EAAE,iCAAiC,CAAC;IACxC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,4BAA4B,CAAC;gBAE1B,EACV,OAAO,EACP,IAAI,EACJ,MAAM,EACN,MAAM,GACP,EAAE;QACD,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,EAAE,iCAAiC,CAAC;QACxC,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,MAAM,CAAC,EAAE,4BAA4B,CAAC;KACvC;IASM,cAAc;CAGtB"}

package/dist/errors.js

@@ -77,17 +77,24 @@ var SignJWTError = class extends Error {
 var MachineTokenVerificationErrorCode = {
   TokenInvalid: "token-invalid",
   InvalidSecretKey: "secret-key-invalid",
-  UnexpectedError: "unexpected-error"
+  UnexpectedError: "unexpected-error",
+  TokenVerificationFailed: "token-verification-failed"
 };
 var MachineTokenVerificationError = class _MachineTokenVerificationError extends Error {
-  constructor({ message, code, status }) {
+  constructor({
+    message,
+    code,
+    status,
+    action
+  }) {
     super(message);
     Object.setPrototypeOf(this, _MachineTokenVerificationError.prototype);
     this.code = code;
     this.status = status;
+    this.action = action;
   }
   getFullMessage() {
-    return `${this.message} (code=${this.code}, status=${this.status})`;
+    return `${this.message} (code=${this.code}, status=${this.status || "n/a"})`;
   }
 };
 // Annotate the CommonJS export names for ESM import in node:

package/dist/errors.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/errors.ts"],"sourcesContent":["export type TokenCarrier = 'header' | 'cookie';\n\nexport const TokenVerificationErrorCode = {\n  InvalidSecretKey: 'clerk_key_invalid',\n};\n\nexport type TokenVerificationErrorCode = (typeof TokenVerificationErrorCode)[keyof typeof TokenVerificationErrorCode];\n\nexport const TokenVerificationErrorReason = {\n  TokenExpired: 'token-expired',\n  TokenInvalid: 'token-invalid',\n  TokenInvalidAlgorithm: 'token-invalid-algorithm',\n  TokenInvalidAuthorizedParties: 'token-invalid-authorized-parties',\n  TokenInvalidSignature: 'token-invalid-signature',\n  TokenNotActiveYet: 'token-not-active-yet',\n  TokenIatInTheFuture: 'token-iat-in-the-future',\n  TokenVerificationFailed: 'token-verification-failed',\n  InvalidSecretKey: 'secret-key-invalid',\n  LocalJWKMissing: 'jwk-local-missing',\n  RemoteJWKFailedToLoad: 'jwk-remote-failed-to-load',\n  RemoteJWKInvalid: 'jwk-remote-invalid',\n  RemoteJWKMissing: 'jwk-remote-missing',\n  JWKFailedToResolve: 'jwk-failed-to-resolve',\n  JWKKidMismatch: 'jwk-kid-mismatch',\n};\n\nexport type TokenVerificationErrorReason =\n  (typeof TokenVerificationErrorReason)[keyof typeof TokenVerificationErrorReason];\n\nexport const TokenVerificationErrorAction = {\n  ContactSupport: 'Contact support@clerk.com',\n  EnsureClerkJWT: 'Make sure that this is a valid Clerk-generated JWT.',\n  SetClerkJWTKey: 'Set the CLERK_JWT_KEY environment variable.',\n  SetClerkSecretKey: 'Set the CLERK_SECRET_KEY environment variable.',\n  EnsureClockSync: 'Make sure your system clock is in sync (e.g. turn off and on automatic time synchronization).',\n};\n\nexport type TokenVerificationErrorAction =\n  (typeof TokenVerificationErrorAction)[keyof typeof TokenVerificationErrorAction];\n\nexport class TokenVerificationError extends Error {\n  action?: TokenVerificationErrorAction;\n  reason: TokenVerificationErrorReason;\n  tokenCarrier?: TokenCarrier;\n\n  constructor({\n    action,\n    message,\n    reason,\n  }: {\n    action?: TokenVerificationErrorAction;\n    message: string;\n    reason: TokenVerificationErrorReason;\n  }) {\n    super(message);\n\n    Object.setPrototypeOf(this, TokenVerificationError.prototype);\n\n    this.reason = reason;\n    this.message = message;\n    this.action = action;\n  }\n\n  public getFullMessage() {\n    return `${[this.message, this.action].filter(m => m).join(' ')} (reason=${this.reason}, token-carrier=${\n      this.tokenCarrier\n    })`;\n  }\n}\n\nexport class SignJWTError extends Error {}\n\nexport const MachineTokenVerificationErrorCode = {\n  TokenInvalid: 'token-invalid',\n  InvalidSecretKey: 'secret-key-invalid',\n  UnexpectedError: 'unexpected-error',\n} as const;\n\nexport type MachineTokenVerificationErrorCode =\n  (typeof MachineTokenVerificationErrorCode)[keyof typeof MachineTokenVerificationErrorCode];\n\nexport class MachineTokenVerificationError extends Error {\n  code: MachineTokenVerificationErrorCode;\n  long_message?: string;\n  status: number;\n\n  constructor({ message, code, status }: { message: string; code: MachineTokenVerificationErrorCode; status: number }) {\n    super(message);\n    Object.setPrototypeOf(this, MachineTokenVerificationError.prototype);\n\n    this.code = code;\n    this.status = status;\n  }\n\n  public getFullMessage() {\n    return `${this.message} (code=${this.code}, status=${this.status})`;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAEO,IAAM,6BAA6B;AAAA,EACxC,kBAAkB;AACpB;AAIO,IAAM,+BAA+B;AAAA,EAC1C,cAAc;AAAA,EACd,cAAc;AAAA,EACd,uBAAuB;AAAA,EACvB,+BAA+B;AAAA,EAC/B,uBAAuB;AAAA,EACvB,mBAAmB;AAAA,EACnB,qBAAqB;AAAA,EACrB,yBAAyB;AAAA,EACzB,kBAAkB;AAAA,EAClB,iBAAiB;AAAA,EACjB,uBAAuB;AAAA,EACvB,kBAAkB;AAAA,EAClB,kBAAkB;AAAA,EAClB,oBAAoB;AAAA,EACpB,gBAAgB;AAClB;AAKO,IAAM,+BAA+B;AAAA,EAC1C,gBAAgB;AAAA,EAChB,gBAAgB;AAAA,EAChB,gBAAgB;AAAA,EAChB,mBAAmB;AAAA,EACnB,iBAAiB;AACnB;AAKO,IAAM,yBAAN,MAAM,gCAA+B,MAAM;AAAA,EAKhD,YAAY;AAAA,IACV;AAAA,IACA;AAAA,IACA;AAAA,EACF,GAIG;AACD,UAAM,OAAO;AAEb,WAAO,eAAe,MAAM,wBAAuB,SAAS;AAE5D,SAAK,SAAS;AACd,SAAK,UAAU;AACf,SAAK,SAAS;AAAA,EAChB;AAAA,EAEO,iBAAiB;AACtB,WAAO,GAAG,CAAC,KAAK,SAAS,KAAK,MAAM,EAAE,OAAO,OAAK,CAAC,EAAE,KAAK,GAAG,CAAC,YAAY,KAAK,MAAM,mBACnF,KAAK,YACP;AAAA,EACF;AACF;AAEO,IAAM,eAAN,cAA2B,MAAM;AAAC;AAElC,IAAM,oCAAoC;AAAA,EAC/C,cAAc;AAAA,EACd,kBAAkB;AAAA,EAClB,iBAAiB;AACnB;AAKO,IAAM,gCAAN,MAAM,uCAAsC,MAAM;AAAA,EAKvD,YAAY,EAAE,SAAS,MAAM,OAAO,GAAiF;AACnH,UAAM,OAAO;AACb,WAAO,eAAe,MAAM,+BAA8B,SAAS;AAEnE,SAAK,OAAO;AACZ,SAAK,SAAS;AAAA,EAChB;AAAA,EAEO,iBAAiB;AACtB,WAAO,GAAG,KAAK,OAAO,UAAU,KAAK,IAAI,YAAY,KAAK,MAAM;AAAA,EAClE;AACF;","names":[]}
+{"version":3,"sources":["../src/errors.ts"],"sourcesContent":["export type TokenCarrier = 'header' | 'cookie';\n\nexport const TokenVerificationErrorCode = {\n  InvalidSecretKey: 'clerk_key_invalid',\n};\n\nexport type TokenVerificationErrorCode = (typeof TokenVerificationErrorCode)[keyof typeof TokenVerificationErrorCode];\n\nexport const TokenVerificationErrorReason = {\n  TokenExpired: 'token-expired',\n  TokenInvalid: 'token-invalid',\n  TokenInvalidAlgorithm: 'token-invalid-algorithm',\n  TokenInvalidAuthorizedParties: 'token-invalid-authorized-parties',\n  TokenInvalidSignature: 'token-invalid-signature',\n  TokenNotActiveYet: 'token-not-active-yet',\n  TokenIatInTheFuture: 'token-iat-in-the-future',\n  TokenVerificationFailed: 'token-verification-failed',\n  InvalidSecretKey: 'secret-key-invalid',\n  LocalJWKMissing: 'jwk-local-missing',\n  RemoteJWKFailedToLoad: 'jwk-remote-failed-to-load',\n  RemoteJWKInvalid: 'jwk-remote-invalid',\n  RemoteJWKMissing: 'jwk-remote-missing',\n  JWKFailedToResolve: 'jwk-failed-to-resolve',\n  JWKKidMismatch: 'jwk-kid-mismatch',\n};\n\nexport type TokenVerificationErrorReason =\n  (typeof TokenVerificationErrorReason)[keyof typeof TokenVerificationErrorReason];\n\nexport const TokenVerificationErrorAction = {\n  ContactSupport: 'Contact support@clerk.com',\n  EnsureClerkJWT: 'Make sure that this is a valid Clerk-generated JWT.',\n  SetClerkJWTKey: 'Set the CLERK_JWT_KEY environment variable.',\n  SetClerkSecretKey: 'Set the CLERK_SECRET_KEY environment variable.',\n  EnsureClockSync: 'Make sure your system clock is in sync (e.g. turn off and on automatic time synchronization).',\n};\n\nexport type TokenVerificationErrorAction =\n  (typeof TokenVerificationErrorAction)[keyof typeof TokenVerificationErrorAction];\n\nexport class TokenVerificationError extends Error {\n  action?: TokenVerificationErrorAction;\n  reason: TokenVerificationErrorReason;\n  tokenCarrier?: TokenCarrier;\n\n  constructor({\n    action,\n    message,\n    reason,\n  }: {\n    action?: TokenVerificationErrorAction;\n    message: string;\n    reason: TokenVerificationErrorReason;\n  }) {\n    super(message);\n\n    Object.setPrototypeOf(this, TokenVerificationError.prototype);\n\n    this.reason = reason;\n    this.message = message;\n    this.action = action;\n  }\n\n  public getFullMessage() {\n    return `${[this.message, this.action].filter(m => m).join(' ')} (reason=${this.reason}, token-carrier=${\n      this.tokenCarrier\n    })`;\n  }\n}\n\nexport class SignJWTError extends Error {}\n\nexport const MachineTokenVerificationErrorCode = {\n  TokenInvalid: 'token-invalid',\n  InvalidSecretKey: 'secret-key-invalid',\n  UnexpectedError: 'unexpected-error',\n  TokenVerificationFailed: 'token-verification-failed',\n} as const;\n\nexport type MachineTokenVerificationErrorCode =\n  (typeof MachineTokenVerificationErrorCode)[keyof typeof MachineTokenVerificationErrorCode];\n\nexport class MachineTokenVerificationError extends Error {\n  code: MachineTokenVerificationErrorCode;\n  long_message?: string;\n  status?: number;\n  action?: TokenVerificationErrorAction;\n\n  constructor({\n    message,\n    code,\n    status,\n    action,\n  }: {\n    message: string;\n    code: MachineTokenVerificationErrorCode;\n    status?: number;\n    action?: TokenVerificationErrorAction;\n  }) {\n    super(message);\n    Object.setPrototypeOf(this, MachineTokenVerificationError.prototype);\n\n    this.code = code;\n    this.status = status;\n    this.action = action;\n  }\n\n  public getFullMessage() {\n    return `${this.message} (code=${this.code}, status=${this.status || 'n/a'})`;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAEO,IAAM,6BAA6B;AAAA,EACxC,kBAAkB;AACpB;AAIO,IAAM,+BAA+B;AAAA,EAC1C,cAAc;AAAA,EACd,cAAc;AAAA,EACd,uBAAuB;AAAA,EACvB,+BAA+B;AAAA,EAC/B,uBAAuB;AAAA,EACvB,mBAAmB;AAAA,EACnB,qBAAqB;AAAA,EACrB,yBAAyB;AAAA,EACzB,kBAAkB;AAAA,EAClB,iBAAiB;AAAA,EACjB,uBAAuB;AAAA,EACvB,kBAAkB;AAAA,EAClB,kBAAkB;AAAA,EAClB,oBAAoB;AAAA,EACpB,gBAAgB;AAClB;AAKO,IAAM,+BAA+B;AAAA,EAC1C,gBAAgB;AAAA,EAChB,gBAAgB;AAAA,EAChB,gBAAgB;AAAA,EAChB,mBAAmB;AAAA,EACnB,iBAAiB;AACnB;AAKO,IAAM,yBAAN,MAAM,gCAA+B,MAAM;AAAA,EAKhD,YAAY;AAAA,IACV;AAAA,IACA;AAAA,IACA;AAAA,EACF,GAIG;AACD,UAAM,OAAO;AAEb,WAAO,eAAe,MAAM,wBAAuB,SAAS;AAE5D,SAAK,SAAS;AACd,SAAK,UAAU;AACf,SAAK,SAAS;AAAA,EAChB;AAAA,EAEO,iBAAiB;AACtB,WAAO,GAAG,CAAC,KAAK,SAAS,KAAK,MAAM,EAAE,OAAO,OAAK,CAAC,EAAE,KAAK,GAAG,CAAC,YAAY,KAAK,MAAM,mBACnF,KAAK,YACP;AAAA,EACF;AACF;AAEO,IAAM,eAAN,cAA2B,MAAM;AAAC;AAElC,IAAM,oCAAoC;AAAA,EAC/C,cAAc;AAAA,EACd,kBAAkB;AAAA,EAClB,iBAAiB;AAAA,EACjB,yBAAyB;AAC3B;AAKO,IAAM,gCAAN,MAAM,uCAAsC,MAAM;AAAA,EAMvD,YAAY;AAAA,IACV;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,GAKG;AACD,UAAM,OAAO;AACb,WAAO,eAAe,MAAM,+BAA8B,SAAS;AAEnE,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,SAAS;AAAA,EAChB;AAAA,EAEO,iBAAiB;AACtB,WAAO,GAAG,KAAK,OAAO,UAAU,KAAK,IAAI,YAAY,KAAK,UAAU,KAAK;AAAA,EAC3E;AACF;","names":[]}

package/dist/errors.mjs

@@ -6,7 +6,7 @@ import {
   TokenVerificationErrorAction,
   TokenVerificationErrorCode,
   TokenVerificationErrorReason
-} from "./chunk-HNJNM32R.mjs";
+} from "./chunk-TCIXZLLW.mjs";
 import "./chunk-RPS7XK5K.mjs";
 export {
   MachineTokenVerificationError,

package/dist/fixtures/index.d.ts

@@ -16,6 +16,18 @@ export declare const mockJwtPayload: {
     sid: string;
     sub: string;
 };
+export declare const mockOAuthAccessTokenJwtPayload: {
+    iss: string;
+    sub: string;
+    client_id: string;
+    scope: string;
+    jti: string;
+    exp: number;
+    iat: number;
+    nbf: number;
+    azp: string;
+    sid: string;
+};
 export declare const mockRsaJwkKid = "ins_2GIoQhbUpy0hX7B2cVkuTMinXoD";
 export declare const mockRsaJwk: {
     use: string;

package/dist/fixtures/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/fixtures/index.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,OAAO,2uBACstB,CAAC;AAG3uB,eAAO,MAAM,cAAc,2uBAC+sB,CAAC;AAE3uB,eAAO,MAAM,uBAAuB,quBACgsB,CAAC;AAEruB,eAAO,MAAM,gBAAgB,+cACib,CAAC;AAK/c,eAAO,MAAM,aAAa;;;;CAIzB,CAAC;AAEF,eAAO,MAAM,cAAc;;;;;;;;CAQ1B,CAAC;AAEF,eAAO,MAAM,aAAa,oCAAoC,CAAC;AAE/D,eAAO,MAAM,UAAU;;;;;;;CAOtB,CAAC;AAEF,eAAO,MAAM,QAAQ;;;;;;;;;CAEpB,CAAC;AAEF,eAAO,MAAM,UAAU,6YACqX,CAAC;AAE7Y,eAAO,MAAM,UAAU;;;;;;CAMtB,CAAC;AAEF,eAAO,MAAM,aAAa,QASE,CAAC;AAE7B,eAAO,MAAM,iBAAiB,usDA2BJ,CAAC;AAE3B,eAAO,MAAM,mBAAmB,+cAQP,CAAC;AAE1B,eAAO,MAAM,kBAAkB,+cAQN,CAAC;AAG1B,eAAO,MAAM,WAAW;;;;;;;;;;;;;CAavB,CAAC;AAEF,eAAO,MAAM,UAAU;;;;;;;CAOtB,CAAC;AAGF,eAAO,MAAM,SAAS,2uBACotB,CAAC;AAE3uB,eAAO,MAAM,MAAM,uDAAuD,CAAC;AAC3E,eAAO,MAAM,MAAM,uDAAuD,CAAC;AAE3E,KAAK,SAAS,GAAG,CAAC,IAAI,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,GAAG,CAAC;IAAC,OAAO,CAAC,EAAE,GAAG,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,KAAK,MAAM,CAAC;AACxF,eAAO,MAAM,SAAS,EAAE,SAWvB,CAAC;AAEF,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAM1E"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/fixtures/index.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,OAAO,2uBACstB,CAAC;AAG3uB,eAAO,MAAM,cAAc,2uBAC+sB,CAAC;AAE3uB,eAAO,MAAM,uBAAuB,quBACgsB,CAAC;AAEruB,eAAO,MAAM,gBAAgB,+cACib,CAAC;AAK/c,eAAO,MAAM,aAAa;;;;CAIzB,CAAC;AAEF,eAAO,MAAM,cAAc;;;;;;;;CAQ1B,CAAC;AAEF,eAAO,MAAM,8BAA8B;;;;;;;;;;;CAU1C,CAAC;AAEF,eAAO,MAAM,aAAa,oCAAoC,CAAC;AAE/D,eAAO,MAAM,UAAU;;;;;;;CAOtB,CAAC;AAEF,eAAO,MAAM,QAAQ;;;;;;;;;CAEpB,CAAC;AAEF,eAAO,MAAM,UAAU,6YACqX,CAAC;AAE7Y,eAAO,MAAM,UAAU;;;;;;CAMtB,CAAC;AAEF,eAAO,MAAM,aAAa,QASE,CAAC;AAE7B,eAAO,MAAM,iBAAiB,usDA2BJ,CAAC;AAE3B,eAAO,MAAM,mBAAmB,+cAQP,CAAC;AAE1B,eAAO,MAAM,kBAAkB,+cAQN,CAAC;AAG1B,eAAO,MAAM,WAAW;;;;;;;;;;;;;CAavB,CAAC;AAEF,eAAO,MAAM,UAAU;;;;;;;CAOtB,CAAC;AAGF,eAAO,MAAM,SAAS,2uBACotB,CAAC;AAE3uB,eAAO,MAAM,MAAM,uDAAuD,CAAC;AAC3E,eAAO,MAAM,MAAM,uDAAuD,CAAC;AAE3E,KAAK,SAAS,GAAG,CAAC,IAAI,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,GAAG,CAAC;IAAC,OAAO,CAAC,EAAE,GAAG,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,KAAK,MAAM,CAAC;AACxF,eAAO,MAAM,SAAS,EAAE,SAWvB,CAAC;AAEF,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAM1E"}

package/dist/fixtures/machine.d.ts

@@ -67,4 +67,6 @@ export declare const mockMachineAuthResponses: {
         readonly errorMessage: "Machine token not found";
     };
 };
+export declare const mockSignedOAuthAccessTokenJwt = "eyJhbGciOiJSUzI1NiIsImtpZCI6Imluc18yR0lvUWhiVXB5MGhYN0IyY1ZrdVRNaW5Yb0QiLCJ0eXAiOiJhdCtqd3QifQ.eyJhenAiOiJodHRwczovL2FjY291bnRzLmluc3BpcmVkLnB1bWEtNzQubGNsLmRldiIsImV4cCI6MTY2NjY0ODU1MCwiaWF0IjoxNjY2NjQ4MjUwLCJpc3MiOiJodHRwczovL2NsZXJrLm9hdXRoLmV4YW1wbGUudGVzdCIsIm5iZiI6MTY2NjY0ODI0MCwic2lkIjoic2Vzc18yR2JEQjRlbk5kQ2E1dlMxenBDM1h6Zzl0SzkiLCJzdWIiOiJ1c2VyXzJ2WVZ0ZXN0VEVTVHRlc3RURVNUdGVzdFRFU1R0ZXN0IiwiY2xpZW50X2lkIjoiY2xpZW50XzJWVFdVenZHQzVVaGRKQ054NnhHMUQ5OGVkYyIsInNjb3BlIjoicmVhZDpmb28gd3JpdGU6YmFyIiwianRpIjoib2F0XzJ4S2E5Qmd2N054TVJERnlRdzhMcFozY1RtVTF2SGpFIn0.Wgw5L2u0nGkxF9Y-5Dje414UEkxq2Fu3_VePeh1-GehCugi0eIXV-QyiXp1ba4pxWWbCfIC_hihzKjwnVb5wrhzqyw8FJpvnvtrHEjt-zSijpS7WlO7ScJDY-PE8zgH-CICnS2CKYSkP3Rbzka9XY_Z6ieUzmBSFdA_0K8pQOdDHv70y04dnL1CjL6XToncnvezioL388Y1UTqlhll8b2Pm4EI7rGdHVKzLcKnKoYpgsBPZLmO7qGPJ5BkHvmg3gOSkmIiziFaEZkoXvjbvEUAt5qEqzaADSaFP6QhRYNtr1s4OD9uj0SK6QaoZTj69XYFuNMNnm7zN_WxvPBMTq9g";
+export declare const mockSignedOAuthAccessTokenJwtApplicationTyp = "eyJhbGciOiJSUzI1NiIsImtpZCI6Imluc18yR0lvUWhiVXB5MGhYN0IyY1ZrdVRNaW5Yb0QiLCJ0eXAiOiJhcHBsaWNhdGlvbi9hdCtqd3QifQ.eyJhenAiOiJodHRwczovL2FjY291bnRzLmluc3BpcmVkLnB1bWEtNzQubGNsLmRldiIsImV4cCI6MTY2NjY0ODU1MCwiaWF0IjoxNjY2NjQ4MjUwLCJpc3MiOiJodHRwczovL2NsZXJrLm9hdXRoLmV4YW1wbGUudGVzdCIsIm5iZiI6MTY2NjY0ODI0MCwic2lkIjoic2Vzc18yR2JEQjRlbk5kQ2E1dlMxenBDM1h6Zzl0SzkiLCJzdWIiOiJ1c2VyXzJ2WVZ0ZXN0VEVTVHRlc3RURVNUdGVzdFRFU1R0ZXN0IiwiY2xpZW50X2lkIjoiY2xpZW50XzJWVFdVenZHQzVVaGRKQ054NnhHMUQ5OGVkYyIsInNjb3BlIjoicmVhZDpmb28gd3JpdGU6YmFyIiwianRpIjoib2F0XzJ4S2E5Qmd2N054TVJERnlRdzhMcFozY1RtVTF2SGpFIn0.GPTvB4doScjzQD0kRMhMebVDREjwcrMWK73OP_kFc3pl0gST29BlWrKMBi8wRxoSJBc2ukO10BPhGxnh15PxCNLyk6xQFWhFBA7XpVxY4T_VHPDU5FEOocPQuqcqZ4cA1GDJST-BH511fxoJnv4kfha46IvQiUMvWCacIj_w12qfZigeb208mTDIeoJQtlYb-sD9u__CVvB4uZOqGb0lIL5-cCbhMPFg-6GQ2DhZ-Eq5tw7oyO6lPrsAaFN9u-59SLvips364ieYNpgcr9Dbo5PDvUSltqxoIXTDFo4esWw6XwUjnGfqCh34LYAhv_2QF2U0-GASBEn4GK-Wfv3wXg";
 //# sourceMappingURL=machine.d.ts.map

package/dist/fixtures/machine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"machine.d.ts","sourceRoot":"","sources":["../../src/fixtures/machine.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,UAAU;;;;CAIb,CAAC;AAEX,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6CnC,CAAC;AAEF,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;CAa3B,CAAC"}
+{"version":3,"file":"machine.d.ts","sourceRoot":"","sources":["../../src/fixtures/machine.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,UAAU;;;;CAIb,CAAC;AAEX,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6CnC,CAAC;AAEF,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;CAa3B,CAAC;AAMX,eAAO,MAAM,6BAA6B,k5BACu2B,CAAC;AAMl5B,eAAO,MAAM,2CAA2C,k6BACy2B,CAAC"}

package/dist/index.d.ts

@@ -8,6 +8,7 @@ export declare const verifyToken: (token: string, options: {
     audience?: string | string[] | undefined;
     authorizedParties?: string[] | undefined;
     clockSkewInMs?: number | undefined;
+    headerType?: string | string[] | undefined;
     secretKey?: string | undefined;
     apiUrl?: string | undefined;
     apiVersion?: string | undefined;

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AACzE,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAEvD,OAAO,KAAK,EAAE,SAAS,EAAE,uBAAuB,EAAE,MAAM,OAAO,CAAC;AAGhE,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAG7D,eAAO,MAAM,WAAW;;;;;;;;;;gFAAiC,CAAC;AAE1D,MAAM,MAAM,YAAY,GAAG,IAAI,CAAC,uBAAuB,EAAE,qBAAqB,GAAG,qBAAqB,CAAC,GACrG,OAAO,CACL,IAAI,CACF,gCAAgC,CAAC,SAAS,CAAC,EAC3C,UAAU,GAAG,QAAQ,GAAG,UAAU,GAAG,WAAW,GAAG,gBAAgB,GAAG,QAAQ,GAAG,aAAa,CAC/F,CACF,GAAG;IAAE,WAAW,CAAC,EAAE,WAAW,CAAC;IAAC,SAAS,CAAC,EAAE,IAAI,CAAC,yBAAyB,EAAE,UAAU,GAAG,OAAO,GAAG,cAAc,CAAC,CAAA;CAAE,CAAC;AAIxH,MAAM,MAAM,WAAW,GAAG;IACxB,SAAS,EAAE,kBAAkB,CAAC;CAC/B,GAAG,SAAS,GACX,UAAU,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE/C,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,YAAY,GAAG,WAAW,CAiBpE;AAED;;GAEG;AACH,YAAY,EAAE,0BAA0B,EAAE,MAAM,iBAAiB,CAAC;AAClE,YAAY,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAC1D;;GAEG;AACH,YAAY,EACV,cAAc,EACd,0BAA0B,EAC1B,iBAAiB,EACjB,SAAS,EACT,uBAAuB,EACvB,uBAAuB,EACvB,UAAU,EACV,eAAe,EACf,UAAU,EACV,SAAS,EACT,gBAAgB,EAChB,mBAAmB,EACnB,sBAAsB,EACtB,YAAY,EACZ,wBAAwB,EACxB,oBAAoB,EACpB,cAAc,EACd,eAAe,EACf,oBAAoB,EACpB,oBAAoB,EACpB,gBAAgB,EAChB,sBAAsB,EACtB,kCAAkC,EAClC,0BAA0B,EAC1B,wBAAwB,EACxB,0BAA0B,EAC1B,0BAA0B,EAC1B,wCAAwC,EACxC,eAAe,EACf,cAAc,EACd,eAAe,EACf,WAAW,EACX,UAAU,EACV,eAAe,EACf,UAAU,EACV,sBAAsB,EACtB,uBAAuB,EACvB,cAAc,EACd,QAAQ,EACR,eAAe,EACf,gBAAgB,EAChB,iBAAiB,EACjB,cAAc,EACd,iBAAiB,EACjB,qBAAqB,EACrB,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,uBAAuB,EACvB,2BAA2B,GAC5B,MAAM,sBAAsB,CAAC;AAE9B;;GAEG;AACH,YAAY,EACV,MAAM,EACN,UAAU,EACV,sBAAsB,EACtB,mBAAmB,EACnB,mBAAmB,EACnB,MAAM,EACN,WAAW,EACX,MAAM,EACN,YAAY,EACZ,eAAe,EACf,OAAO,EACP,QAAQ,EACR,oBAAoB,EACpB,gBAAgB,EAChB,UAAU,EACV,WAAW,EACX,OAAO,EACP,QAAQ,EACR,gBAAgB,EAChB,gBAAgB,EAChB,YAAY,EACZ,kBAAkB,EAClB,8BAA8B,EAC9B,sBAAsB,EACtB,sBAAsB,EACtB,oCAAoC,EACpC,oBAAoB,EACpB,WAAW,EACX,cAAc,EACd,OAAO,EACP,WAAW,EACX,aAAa,EACb,UAAU,EACV,KAAK,EACL,IAAI,EACJ,YAAY,EACZ,aAAa,EACb,WAAW,EACX,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,iBAAiB,CAAC;AAEzB;;GAEG;AACH,YAAY,EACV,iBAAiB,EACjB,wBAAwB,EACxB,8BAA8B,EAC9B,kCAAkC,EAClC,kCAAkC,EAClC,gBAAgB,EAChB,sBAAsB,EACtB,mBAAmB,EACnB,eAAe,EACf,gBAAgB,EAChB,yBAAyB,EACzB,YAAY,EACZ,gBAAgB,EAChB,iCAAiC,EACjC,+BAA+B,EAC/B,mCAAmC,GACpC,MAAM,0BAA0B,CAAC;AAElC;;GAEG;AACH,YAAY,EAAE,UAAU,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC/E,YAAY,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AACzE,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAEvD,OAAO,KAAK,EAAE,SAAS,EAAE,uBAAuB,EAAE,MAAM,OAAO,CAAC;AAGhE,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAG7D,eAAO,MAAM,WAAW;;;;;;;;;;;gFAAiC,CAAC;AAE1D,MAAM,MAAM,YAAY,GAAG,IAAI,CAAC,uBAAuB,EAAE,qBAAqB,GAAG,qBAAqB,CAAC,GACrG,OAAO,CACL,IAAI,CACF,gCAAgC,CAAC,SAAS,CAAC,EAC3C,UAAU,GAAG,QAAQ,GAAG,UAAU,GAAG,WAAW,GAAG,gBAAgB,GAAG,QAAQ,GAAG,aAAa,CAC/F,CACF,GAAG;IAAE,WAAW,CAAC,EAAE,WAAW,CAAC;IAAC,SAAS,CAAC,EAAE,IAAI,CAAC,yBAAyB,EAAE,UAAU,GAAG,OAAO,GAAG,cAAc,CAAC,CAAA;CAAE,CAAC;AAIxH,MAAM,MAAM,WAAW,GAAG;IACxB,SAAS,EAAE,kBAAkB,CAAC;CAC/B,GAAG,SAAS,GACX,UAAU,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE/C,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,YAAY,GAAG,WAAW,CAiBpE;AAED;;GAEG;AACH,YAAY,EAAE,0BAA0B,EAAE,MAAM,iBAAiB,CAAC;AAClE,YAAY,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAC1D;;GAEG;AACH,YAAY,EACV,cAAc,EACd,0BAA0B,EAC1B,iBAAiB,EACjB,SAAS,EACT,uBAAuB,EACvB,uBAAuB,EACvB,UAAU,EACV,eAAe,EACf,UAAU,EACV,SAAS,EACT,gBAAgB,EAChB,mBAAmB,EACnB,sBAAsB,EACtB,YAAY,EACZ,wBAAwB,EACxB,oBAAoB,EACpB,cAAc,EACd,eAAe,EACf,oBAAoB,EACpB,oBAAoB,EACpB,gBAAgB,EAChB,sBAAsB,EACtB,kCAAkC,EAClC,0BAA0B,EAC1B,wBAAwB,EACxB,0BAA0B,EAC1B,0BAA0B,EAC1B,wCAAwC,EACxC,eAAe,EACf,cAAc,EACd,eAAe,EACf,WAAW,EACX,UAAU,EACV,eAAe,EACf,UAAU,EACV,sBAAsB,EACtB,uBAAuB,EACvB,cAAc,EACd,QAAQ,EACR,eAAe,EACf,gBAAgB,EAChB,iBAAiB,EACjB,cAAc,EACd,iBAAiB,EACjB,qBAAqB,EACrB,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,uBAAuB,EACvB,2BAA2B,GAC5B,MAAM,sBAAsB,CAAC;AAE9B;;GAEG;AACH,YAAY,EACV,MAAM,EACN,UAAU,EACV,sBAAsB,EACtB,mBAAmB,EACnB,mBAAmB,EACnB,MAAM,EACN,WAAW,EACX,MAAM,EACN,YAAY,EACZ,eAAe,EACf,OAAO,EACP,QAAQ,EACR,oBAAoB,EACpB,gBAAgB,EAChB,UAAU,EACV,WAAW,EACX,OAAO,EACP,QAAQ,EACR,gBAAgB,EAChB,gBAAgB,EAChB,YAAY,EACZ,kBAAkB,EAClB,8BAA8B,EAC9B,sBAAsB,EACtB,sBAAsB,EACtB,oCAAoC,EACpC,oBAAoB,EACpB,WAAW,EACX,cAAc,EACd,OAAO,EACP,WAAW,EACX,aAAa,EACb,UAAU,EACV,KAAK,EACL,IAAI,EACJ,YAAY,EACZ,aAAa,EACb,WAAW,EACX,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,iBAAiB,CAAC;AAEzB;;GAEG;AACH,YAAY,EACV,iBAAiB,EACjB,wBAAwB,EACxB,8BAA8B,EAC9B,kCAAkC,EAClC,kCAAkC,EAClC,gBAAgB,EAChB,sBAAsB,EACtB,mBAAmB,EACnB,eAAe,EACf,gBAAgB,EAChB,yBAAyB,EACzB,YAAY,EACZ,gBAAgB,EAChB,iCAAiC,EACjC,+BAA+B,EAC/B,mCAAmC,GACpC,MAAM,0BAA0B,CAAC;AAElC;;GAEG;AACH,YAAY,EAAE,UAAU,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC/E,YAAY,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/index.js

@@ -1668,7 +1668,7 @@ var snakecase_keys_default = snakecaseKeys;
 // src/constants.ts
 var API_URL = "https://api.clerk.com";
 var API_VERSION = "v1";
-var USER_AGENT = `${"@clerk/backend"}@${"3.0.0-snapshot.v20251204143242"}`;
+var USER_AGENT = `${"@clerk/backend"}@${"3.0.0-snapshot.v20251208202852"}`;
 var MAX_CACHE_LAST_UPDATED_AT_SECONDS = 5 * 60;
 var SUPPORTED_BAPI_VERSION = "2025-11-10";
 var Attributes = {
@@ -2330,6 +2330,26 @@ var IdPOAuthAccessToken = class _IdPOAuthAccessToken {
       data.updated_at
     );
   }
+  /**
+   * Creates an IdPOAuthAccessToken from a JWT payload.
+   * Maps standard JWT claims and OAuth-specific fields to token properties.
+   */
+  static fromJwtPayload(payload, clockSkewInMs = 5e3) {
+    const oauthPayload = payload;
+    return new _IdPOAuthAccessToken(
+      oauthPayload.jti ?? "",
+      oauthPayload.client_id ?? "",
+      "oauth_token",
+      payload.sub,
+      oauthPayload.scp ?? oauthPayload.scope?.split(" ") ?? [],
+      false,
+      null,
+      payload.exp * 1e3 <= Date.now() - clockSkewInMs,
+      payload.exp,
+      payload.iat,
+      payload.iat
+    );
+  }
 };
 
 // src/api/resources/Instance.ts
@@ -3625,17 +3645,24 @@ var TokenVerificationError = class _TokenVerificationError extends Error {
 var MachineTokenVerificationErrorCode = {
   TokenInvalid: "token-invalid",
   InvalidSecretKey: "secret-key-invalid",
-  UnexpectedError: "unexpected-error"
+  UnexpectedError: "unexpected-error",
+  TokenVerificationFailed: "token-verification-failed"
 };
 var MachineTokenVerificationError = class _MachineTokenVerificationError extends Error {
-  constructor({ message, code, status }) {
+  constructor({
+    message,
+    code,
+    status,
+    action
+  }) {
     super(message);
     Object.setPrototypeOf(this, _MachineTokenVerificationError.prototype);
     this.code = code;
     this.status = status;
+    this.action = action;
   }
   getFullMessage() {
-    return `${this.message} (code=${this.code}, status=${this.status})`;
+    return `${this.message} (code=${this.code}, status=${this.status || "n/a"})`;
   }
 };
 
@@ -3773,15 +3800,16 @@ var assertAudienceClaim = (aud, audience) => {
     }
   }
 };
-var assertHeaderType = (typ) => {
+var assertHeaderType = (typ, allowedTypes = "JWT") => {
   if (typeof typ === "undefined") {
     return;
   }
-  if (typ !== "JWT") {
+  const allowed = Array.isArray(allowedTypes) ? allowedTypes : [allowedTypes];
+  if (!allowed.includes(typ)) {
     throw new TokenVerificationError({
       action: TokenVerificationErrorAction.EnsureClerkJWT,
       reason: TokenVerificationErrorReason.TokenInvalid,
-      message: `Invalid JWT type ${JSON.stringify(typ)}. Expected "JWT".`
+      message: `Invalid JWT type ${JSON.stringify(typ)}. Expected "${allowed.join(", ")}".`
     });
   }
 };
@@ -3952,7 +3980,7 @@ function decodeJwt(token) {
   return { data };
 }
 async function verifyJwt(token, options) {
-  const { audience, authorizedParties, clockSkewInMs, key } = options;
+  const { audience, authorizedParties, clockSkewInMs, key, headerType } = options;
   const clockSkew = clockSkewInMs || DEFAULT_CLOCK_SKEW_IN_MS;
   const { data: decoded, errors } = decodeJwt(token);
   if (errors) {
@@ -3961,7 +3989,7 @@ async function verifyJwt(token, options) {
   const { header, payload } = decoded;
   try {
     const { typ, alg } = header;
-    assertHeaderType(typ);
+    assertHeaderType(typ, headerType);
     assertHeaderAlgorithm(alg);
     const { azp, sub, aud, iat, exp, nbf } = payload;
     assertSubClaim(sub);
@@ -4431,14 +4459,33 @@ var M2M_TOKEN_PREFIX = "mt_";
 var OAUTH_TOKEN_PREFIX = "oat_";
 var API_KEY_PREFIX = "ak_";
 var MACHINE_TOKEN_PREFIXES = [M2M_TOKEN_PREFIX, OAUTH_TOKEN_PREFIX, API_KEY_PREFIX];
+var JwtFormatRegExp = /^[a-zA-Z0-9\-_]+\.[a-zA-Z0-9\-_]+\.[a-zA-Z0-9\-_]+$/;
+function isJwtFormat(token) {
+  return JwtFormatRegExp.test(token);
+}
+var OAUTH_ACCESS_TOKEN_TYPES = ["at+jwt", "application/at+jwt"];
+function isOAuthJwt(token) {
+  if (!isJwtFormat(token)) {
+    return false;
+  }
+  try {
+    const { data, errors } = decodeJwt(token);
+    return !errors && !!data && OAUTH_ACCESS_TOKEN_TYPES.includes(data.header.typ);
+  } catch {
+    return false;
+  }
+}
 function isMachineTokenByPrefix(token) {
   return MACHINE_TOKEN_PREFIXES.some((prefix) => token.startsWith(prefix));
 }
+function isMachineToken(token) {
+  return isMachineTokenByPrefix(token) || isOAuthJwt(token);
+}
 function getMachineTokenType(token) {
   if (token.startsWith(M2M_TOKEN_PREFIX)) {
     return TokenType.M2MToken;
   }
-  if (token.startsWith(OAUTH_TOKEN_PREFIX)) {
+  if (token.startsWith(OAUTH_TOKEN_PREFIX) || isOAuthJwt(token)) {
     return TokenType.OAuthToken;
   }
   if (token.startsWith(API_KEY_PREFIX)) {
@@ -4537,7 +4584,91 @@ async function verifyM2MToken(token, options) {
     return handleClerkAPIError(TokenType.M2MToken, err, "Machine token not found");
   }
 }
+async function verifyJwtOAuthToken(accessToken, options) {
+  let decoded;
+  try {
+    decoded = decodeJwt(accessToken);
+  } catch (e) {
+    return {
+      data: void 0,
+      tokenType: TokenType.OAuthToken,
+      errors: [
+        new MachineTokenVerificationError({
+          code: MachineTokenVerificationErrorCode.TokenInvalid,
+          message: e.message
+        })
+      ]
+    };
+  }
+  const { data: decodedResult, errors } = decoded;
+  if (errors) {
+    return {
+      data: void 0,
+      tokenType: TokenType.OAuthToken,
+      errors: [
+        new MachineTokenVerificationError({
+          code: MachineTokenVerificationErrorCode.TokenInvalid,
+          message: errors[0].message
+        })
+      ]
+    };
+  }
+  const { header } = decodedResult;
+  const { kid } = header;
+  let key;
+  try {
+    if (options.jwtKey) {
+      key = loadClerkJwkFromPem({ kid, pem: options.jwtKey });
+    } else if (options.secretKey) {
+      key = await loadClerkJWKFromRemote({ ...options, kid });
+    } else {
+      return {
+        data: void 0,
+        tokenType: TokenType.OAuthToken,
+        errors: [
+          new MachineTokenVerificationError({
+            action: TokenVerificationErrorAction.SetClerkJWTKey,
+            message: "Failed to resolve JWK during verification.",
+            code: MachineTokenVerificationErrorCode.TokenVerificationFailed
+          })
+        ]
+      };
+    }
+    const { data: payload, errors: verifyErrors } = await verifyJwt(accessToken, {
+      ...options,
+      key,
+      headerType: OAUTH_ACCESS_TOKEN_TYPES
+    });
+    if (verifyErrors) {
+      return {
+        data: void 0,
+        tokenType: TokenType.OAuthToken,
+        errors: [
+          new MachineTokenVerificationError({
+            code: MachineTokenVerificationErrorCode.TokenVerificationFailed,
+            message: verifyErrors[0].message
+          })
+        ]
+      };
+    }
+    const token = IdPOAuthAccessToken.fromJwtPayload(payload, options.clockSkewInMs);
+    return { data: token, tokenType: TokenType.OAuthToken, errors: void 0 };
+  } catch (error) {
+    return {
+      tokenType: TokenType.OAuthToken,
+      errors: [
+        new MachineTokenVerificationError({
+          code: MachineTokenVerificationErrorCode.TokenVerificationFailed,
+          message: error.message
+        })
+      ]
+    };
+  }
+}
 async function verifyOAuthToken(accessToken, options) {
+  if (isJwtFormat(accessToken)) {
+    return verifyJwtOAuthToken(accessToken, options);
+  }
   try {
     const client = createBackendApiClient(options);
     const verifiedToken = await client.idPOAuthAccessToken.verify(accessToken);
@@ -4559,7 +4690,7 @@ async function verifyMachineAuthToken(token, options) {
   if (token.startsWith(M2M_TOKEN_PREFIX)) {
     return verifyM2MToken(token, options);
   }
-  if (token.startsWith(OAUTH_TOKEN_PREFIX)) {
+  if (token.startsWith(OAUTH_TOKEN_PREFIX) || isJwtFormat(token)) {
     return verifyOAuthToken(token, options);
   }
   if (token.startsWith(API_KEY_PREFIX)) {
@@ -5287,7 +5418,7 @@ function isTokenTypeInAcceptedArray(acceptsToken, authenticateContext) {
   let parsedTokenType = null;
   const { tokenInHeader } = authenticateContext;
   if (tokenInHeader) {
-    if (isMachineTokenByPrefix(tokenInHeader)) {
+    if (isMachineToken(tokenInHeader)) {
       parsedTokenType = getMachineTokenType(tokenInHeader);
     } else {
       parsedTokenType = TokenType.SessionToken;
@@ -5697,7 +5828,7 @@ var authenticateRequest = (async (request, options) => {
     if (!tokenInHeader) {
       return handleSessionTokenError(new Error("Missing token in header"), "header");
     }
-    if (!isMachineTokenByPrefix(tokenInHeader)) {
+    if (!isMachineToken(tokenInHeader)) {
       return signedOut({
         tokenType: acceptsToken,
         authenticateContext,
@@ -5726,7 +5857,7 @@ var authenticateRequest = (async (request, options) => {
     if (!tokenInHeader) {
       return handleSessionTokenError(new Error("Missing token in header"), "header");
     }
-    if (isMachineTokenByPrefix(tokenInHeader)) {
+    if (isMachineToken(tokenInHeader)) {
       const parsedTokenType = getMachineTokenType(tokenInHeader);
       const mismatchState = checkTokenTypeMismatch(parsedTokenType, acceptsToken, authenticateContext);
       if (mismatchState) {