auth51 0.1.0__tar.gz

auth51-0.1.0/.github/workflows/publish.yml

@@ -0,0 +1,33 @@
+name: Publish to PyPI
+
+# Publishes on a GitHub Release. PyPI Trusted Publishing (OIDC) — no stored API
+# token. Configure the trusted publisher on PyPI first: project "auth51" →
+# publisher = this repo, workflow "publish.yml", environment "pypi".
+# NOTE: auth51 depends on auth51-checksum — publish that project to PyPI FIRST,
+# or `pip install auth51` won't resolve for anyone.
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch: {}
+
+permissions:
+  contents: read
+
+jobs:
+  pypi:
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      # Job-level permissions REPLACE the workflow-level block (not merged), so
+      # both must be listed here or checkout 404s on a private repo.
+      contents: read    # let actions/checkout read the (private) repo
+      id-token: write   # mint the OIDC token PyPI verifies (no stored secret)
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - run: python -m pip install --upgrade build
+      - run: python -m build
+      - uses: pypa/gh-action-pypi-publish@release/v1

auth51-0.1.0/.gitignore

@@ -0,0 +1,6 @@
+.venv/
+__pycache__/
+*.pyc
+*.egg-info/
+.pytest_cache/
+dist/

auth51-0.1.0/PKG-INFO

@@ -0,0 +1,67 @@
+Metadata-Version: 2.4
+Name: auth51
+Version: 0.1.0
+Summary: auth51 client (embed mode) — in-process egress interception that gives every agent action a scoped, verifiable, DPoP-bound intent token, minted at the source and verified at the resource.
+Project-URL: Homepage, https://auth51.com
+Project-URL: Repository, https://github.com/unforge-io/auth51-client-python
+Author-email: unforge <dev-admin@unforge.io>
+License: Proprietary
+Keywords: agent-identity,ai-agents,auth51,dpop,intent-token,mcp,oauth
+Classifier: Intended Audience :: Developers
+Classifier: License :: Other/Proprietary License
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Libraries :: Python Modules
+Requires-Python: >=3.10
+Requires-Dist: auth51-checksum>=0.1.1
+Requires-Dist: cryptography>=42
+Requires-Dist: pyjwt>=2.9
+Provides-Extra: dev
+Requires-Dist: httpx>=0.27; extra == 'dev'
+Requires-Dist: pytest>=8; extra == 'dev'
+Description-Content-Type: text/markdown
+
+# auth51 — Python client (embed mode)
+
+The in-process enforcement point: it intercepts your agent's egress and gives
+every governed call a **scoped, verifiable intent token** — minted at the source,
+verified at the resource. This is the generalized, MCP-era successor to the
+original A-JWT client shim, with **contextvar-based agent attribution** (no call-
+stack introspection) per DESIGN §7b.
+
+It's the **durable, unbypassable** path: it sees *all* egress in-process (native
+tool calls *and* MCP calls), and depends only on the HTTP library — not on any
+agent host's conventions.
+
+## Use
+```python
+import auth51
+
+auth51.configure(
+    authority_url="https://authority.auth51.com",
+    client_id="...", client_secret="...",
+    audiences=["api.internal"],          # hosts to govern; everything else passes through
+)
+
+with auth51.agent("ReviewBot", checksum=agent_checksum, scope="read:repo"):
+    httpx.get("https://api.internal/repos/...")   # ← stamped with an intent token
+```
+Config can also come from env: `AUTH51_AUTHORITY_URL`, `AUTH51_CLIENT_ID`,
+`AUTH51_CLIENT_SECRET`, `AUTH51_AUDIENCES` (comma-sep), `AUTH51_FAIL_OPEN`.
+
+## How it works
+- **One import installs it** (idempotent; a no-op until configured + inside an `agent()` context).
+- A framework adapter (LangChain/CrewAI — next) or the app sets the current agent via a contextvar at the tool-call boundary; the interceptor reads it.
+- On governed egress: mint a scoped intent token (Hop A) → attach as a Bearer header → forward. Minting uses **stdlib urllib** so it never re-enters the patched HTTP client.
+- **fail-open** by default (mint failure → forward unstamped, don't wedge the agent); set `fail_open=False` to fail closed.
+
+## Retained from the original A-JWT client shim
+- **Startup-sync (`load_agents`)** — preload registered agents from the authority, index by checksum, detect collisions, and fail-fast on drift when the app declares expected checksums. *Boot-time validation: a mis-deployed agent is caught before it runs.*
+- **Workflow seams** — `with auth51.workflow(id): ...` + `record_step(...)` track an execution; the chain + completed-steps + `prev_jti` ride into each intent token's `delegation_context` (§4.3 tamper-evident trace).
+- **contextvar attribution** + smart caching — kept; **call-stack introspection dropped.**
+
+## Status
+- ✅ contextvar agent attribution · httpx **sync + async** + **requests** interception · mint + attach · fail-open/closed
+- ✅ `load_agents()` startup-sync (cache + collision + drift validation) · workflow seams (delegation_context + `prev_jti` chain)
+- ✅ LangChain adapter (`auth51.adapters.langchain.Auth51CallbackHandler`) — sets agent context + records steps at tool boundaries
+- ⏭️ next: PoP signing (the `cnf` binding) · MCP `_meta` injection · `aiohttp` · local checksum recompute (shared lib) · live e2e against the deployed authority

auth51-0.1.0/README.md

@@ -0,0 +1,44 @@
+# auth51 — Python client (embed mode)
+
+The in-process enforcement point: it intercepts your agent's egress and gives
+every governed call a **scoped, verifiable intent token** — minted at the source,
+verified at the resource. This is the generalized, MCP-era successor to the
+original A-JWT client shim, with **contextvar-based agent attribution** (no call-
+stack introspection) per DESIGN §7b.
+
+It's the **durable, unbypassable** path: it sees *all* egress in-process (native
+tool calls *and* MCP calls), and depends only on the HTTP library — not on any
+agent host's conventions.
+
+## Use
+```python
+import auth51
+
+auth51.configure(
+    authority_url="https://authority.auth51.com",
+    client_id="...", client_secret="...",
+    audiences=["api.internal"],          # hosts to govern; everything else passes through
+)
+
+with auth51.agent("ReviewBot", checksum=agent_checksum, scope="read:repo"):
+    httpx.get("https://api.internal/repos/...")   # ← stamped with an intent token
+```
+Config can also come from env: `AUTH51_AUTHORITY_URL`, `AUTH51_CLIENT_ID`,
+`AUTH51_CLIENT_SECRET`, `AUTH51_AUDIENCES` (comma-sep), `AUTH51_FAIL_OPEN`.
+
+## How it works
+- **One import installs it** (idempotent; a no-op until configured + inside an `agent()` context).
+- A framework adapter (LangChain/CrewAI — next) or the app sets the current agent via a contextvar at the tool-call boundary; the interceptor reads it.
+- On governed egress: mint a scoped intent token (Hop A) → attach as a Bearer header → forward. Minting uses **stdlib urllib** so it never re-enters the patched HTTP client.
+- **fail-open** by default (mint failure → forward unstamped, don't wedge the agent); set `fail_open=False` to fail closed.
+
+## Retained from the original A-JWT client shim
+- **Startup-sync (`load_agents`)** — preload registered agents from the authority, index by checksum, detect collisions, and fail-fast on drift when the app declares expected checksums. *Boot-time validation: a mis-deployed agent is caught before it runs.*
+- **Workflow seams** — `with auth51.workflow(id): ...` + `record_step(...)` track an execution; the chain + completed-steps + `prev_jti` ride into each intent token's `delegation_context` (§4.3 tamper-evident trace).
+- **contextvar attribution** + smart caching — kept; **call-stack introspection dropped.**
+
+## Status
+- ✅ contextvar agent attribution · httpx **sync + async** + **requests** interception · mint + attach · fail-open/closed
+- ✅ `load_agents()` startup-sync (cache + collision + drift validation) · workflow seams (delegation_context + `prev_jti` chain)
+- ✅ LangChain adapter (`auth51.adapters.langchain.Auth51CallbackHandler`) — sets agent context + records steps at tool boundaries
+- ⏭️ next: PoP signing (the `cnf` binding) · MCP `_meta` injection · `aiohttp` · local checksum recompute (shared lib) · live e2e against the deployed authority

auth51-0.1.0/pyproject.toml

@@ -0,0 +1,51 @@
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[project]
+name = "auth51"
+version = "0.1.0"
+description = "auth51 client (embed mode) — in-process egress interception that gives every agent action a scoped, verifiable, DPoP-bound intent token, minted at the source and verified at the resource."
+readme = "README.md"
+requires-python = ">=3.10"
+license = { text = "Proprietary" }
+authors = [{ name = "unforge", email = "dev-admin@unforge.io" }]
+keywords = ["auth51", "ai-agents", "agent-identity", "oauth", "dpop", "mcp", "intent-token"]
+classifiers = [
+    "License :: Other/Proprietary License",
+    "Programming Language :: Python :: 3",
+    "Intended Audience :: Developers",
+    "Topic :: Security",
+    "Topic :: Software Development :: Libraries :: Python Modules",
+]
+# auth51-checksum is the shared registration-contract hash (stdlib-only),
+# published separately to PyPI. The rest of the core uses only stdlib (urllib +
+# hashlib/hmac) — httpx/requests are patched only if present.
+dependencies = [
+    "auth51-checksum>=0.1.1",
+    # Proof-of-Possession (DPoP / RFC 9449) — ephemeral key gen + proof signing.
+    # PoP degrades to a no-op if these are somehow absent (see pop.py).
+    "cryptography>=42",
+    "pyjwt>=2.9",
+]
+
+[project.optional-dependencies]
+dev = ["pytest>=8", "httpx>=0.27"]
+
+[project.urls]
+Homepage = "https://auth51.com"
+Repository = "https://github.com/unforge-io/auth51-client-python"
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/auth51"]
+# _debug.py is demo-only (attack injection + blocking breakpoints). Keep it OUT
+# of the published artifact — it stays in the source tree / vendored copies for
+# the scenario+workforce live demo, and the interceptor loads it optionally.
+exclude = ["src/auth51/_debug.py"]
+
+[tool.hatch.build.targets.sdist]
+exclude = ["src/auth51/_debug.py", "tests"]
+
+[tool.pytest.ini_options]
+pythonpath = ["src"]
+testpaths = ["tests"]

auth51-0.1.0/src/auth51/__init__.py

@@ -0,0 +1,47 @@
+"""
+auth51 — the in-process client (embed mode).
+
+One import installs egress interception (DESIGN §7b: activation = one import).
+It's a no-op until you `configure(...)` an authority + audiences AND wrap agent
+work in `auth51.agent(...)`. Then every governed outbound call carries a scoped,
+verifiable intent token — minted at the source, verified at the resource.
+
+    import auth51
+    auth51.configure(authority_url=..., client_id=..., client_secret=...,
+                     audiences=["api.internal"])
+    with auth51.agent("ReviewBot", checksum=cs, scope="read:repo"):
+        httpx.get("https://api.internal/...")   # ← stamped with an intent token
+"""
+from __future__ import annotations
+
+from .config import Config, configure, get_config, load_env
+from .context import (
+    AgentContext, agent, current, current_derived, effective,
+    workflow, start_workflow, end_workflow, current_workflow, record_step,
+)
+from .identity import Candidate, DerivedIdentity, derive_identity
+from .interceptor import install, uninstall, on_identity_event
+from .obs import observe, current_obs
+from .mcp import (
+    INTENT_META_KEY, build_intent_meta, exchange_intent, extract_intent,
+    incoming_intent, inject_intent, mint_and_inject, mint_for_tool,
+    scope_for_tool, serving,
+)
+from .registry import load_agents, registered_agents, agent_for_checksum, candidates
+
+__all__ = [
+    "Config", "configure", "get_config", "load_env",
+    "AgentContext", "agent", "current", "current_derived", "effective",
+    "workflow", "start_workflow", "end_workflow", "current_workflow", "record_step",
+    "Candidate", "DerivedIdentity", "derive_identity",
+    "install", "uninstall", "on_identity_event",
+    "observe", "current_obs",
+    "INTENT_META_KEY", "build_intent_meta", "extract_intent", "inject_intent",
+    "mint_and_inject", "mint_for_tool", "scope_for_tool",
+    "serving", "incoming_intent", "exchange_intent",
+    "load_agents", "registered_agents", "agent_for_checksum", "candidates",
+]
+
+# Activation = one import. Idempotent; pure passthrough until configured.
+load_env()
+install()

auth51-0.1.0/src/auth51/adapters/langchain.py

@@ -0,0 +1,61 @@
+"""
+LangChain adapter — set the auth51 agent context + record workflow steps at tool
+boundaries, so `import auth51` + this callback handler = governed egress with no
+other app changes. This generalizes the original clientshim's tool wrapper (which
+set the agent contextvar and recorded steps) — minus the framework lock-in and
+the call-stack introspection.
+
+    from langchain.agents import AgentExecutor
+    from auth51.adapters.langchain import Auth51CallbackHandler
+
+    handler = Auth51CallbackHandler(agent_id="ReviewBot", checksum=cs)
+    executor.invoke({...}, config={"callbacks": [handler]})
+
+Import is lazy: this module requires `langchain_core`. The rest of auth51 works
+without it.
+"""
+from __future__ import annotations
+
+from typing import Any, Dict, Optional
+
+try:
+    from langchain_core.callbacks import BaseCallbackHandler
+except ImportError as exc:  # pragma: no cover
+    raise ImportError(
+        "auth51.adapters.langchain requires langchain_core "
+        "(`pip install langchain-core`)."
+    ) from exc
+
+from ..context import AgentContext, _reset_agent, _set_agent, record_step
+
+
+class Auth51CallbackHandler(BaseCallbackHandler):
+    """Binds tool execution to an agent identity for auth51 egress stamping."""
+
+    def __init__(self, agent_id: str, checksum: Optional[str] = None, scope: Optional[str] = None):
+        self.agent_id = agent_id
+        self.checksum = checksum
+        self.scope = scope
+        self._runs: Dict[Any, tuple] = {}   # run_id -> (reset_token, tool_name)
+
+    def on_tool_start(self, serialized: Dict[str, Any], input_str: str, *, run_id=None, **kwargs) -> None:
+        tool = (serialized or {}).get("name") or kwargs.get("name") or ""
+        ctx = AgentContext(
+            agent_id=self.agent_id, checksum=self.checksum,
+            scope=self.scope, tool=tool, provenance="llm-declared",
+        )
+        token = _set_agent(ctx)
+        self._runs[run_id] = (token, tool)
+        record_step(self.agent_id, tool, "started")
+
+    def on_tool_end(self, output: Any, *, run_id=None, **kwargs) -> None:
+        token, tool = self._runs.pop(run_id, (None, ""))
+        record_step(self.agent_id, tool, "completed")
+        if token is not None:
+            _reset_agent(token)
+
+    def on_tool_error(self, error: BaseException, *, run_id=None, **kwargs) -> None:
+        token, tool = self._runs.pop(run_id, (None, ""))
+        record_step(self.agent_id, tool, "failed", error=str(error))
+        if token is not None:
+            _reset_agent(token)

auth51-0.1.0/src/auth51/authority.py

@@ -0,0 +1,241 @@
+"""
+Authority client — mints intent tokens. Uses stdlib urllib (NOT httpx/requests)
+on purpose: those are the libraries the interceptor patches, so minting via them
+would re-enter the interceptor (infinite recursion). urllib sidesteps that
+entirely and keeps the core dependency-free.
+
+Contract mirrors auth51-contracts (the authority OpenAPI): client_credentials →
+OAuth token carrying `generate:intent-token` + delegated scope, then
+POST /v1/intent/token with grant_type=agent_checksum.
+"""
+from __future__ import annotations
+
+import json
+import time
+import urllib.parse
+import urllib.request
+from typing import Dict, Optional, Tuple
+
+from .config import get_config
+
+
+class AuthorityError(Exception):
+    pass
+
+
+# OAuth client_credentials tokens cached per scope-set (mirrors the proxy).
+_oauth_cache: Dict[str, Tuple[str, float]] = {}
+
+
+def _post_form(url: str, data: dict, headers: Optional[dict] = None) -> dict:
+    body = urllib.parse.urlencode(data).encode()
+    req = urllib.request.Request(
+        url, data=body, method="POST",
+        headers={"content-type": "application/x-www-form-urlencoded", **(headers or {})},
+    )
+    with urllib.request.urlopen(req, timeout=10) as r:  # noqa: S310 (trusted authority URL)
+        return json.loads(r.read().decode())
+
+
+def _post_json(url: str, obj: dict, headers: Optional[dict] = None) -> dict:
+    body = json.dumps(obj).encode()
+    req = urllib.request.Request(
+        url, data=body, method="POST",
+        headers={"content-type": "application/json", **(headers or {})},
+    )
+    with urllib.request.urlopen(req, timeout=10) as r:  # noqa: S310
+        return json.loads(r.read().decode())
+
+
+def get_json(url: str, headers: Optional[dict] = None) -> dict:
+    req = urllib.request.Request(url, method="GET", headers=headers or {})
+    with urllib.request.urlopen(req, timeout=10) as r:  # noqa: S310
+        return json.loads(r.read().decode())
+
+
+def get_oauth_token(full_scope: str) -> str:
+    """An auth51 OAuth token for an exact scope string, cached per scope-set.
+
+    Keyed path (on-prem / local / anywhere with a secret): client_credentials
+    using the configured client_id/client_secret. Keyless path (cloud): if no
+    secret is configured, prove the runtime's ambient workload identity (AWS
+    today) and let the authority mint — no stored secret. See
+    DESIGN-keyless-workload-identity.md."""
+    cfg = get_config()
+    now = time.time()
+    cached = _oauth_cache.get(full_scope)
+    if cached and now < cached[1] - 5:
+        return cached[0]
+    if cfg.client_id and cfg.client_secret:
+        data = _post_form(
+            cfg.authority_url.rstrip("/") + "/v1/oauth/token",
+            {
+                "grant_type": "client_credentials",
+                "client_id": cfg.client_id,
+                "client_secret": cfg.client_secret,
+                "scope": full_scope,
+            },
+        )
+    else:
+        data = _acquire_workload_token(full_scope)
+    tok = data.get("access_token")
+    if not tok:
+        raise AuthorityError("OAuth token endpoint returned no access_token")
+    _oauth_cache[full_scope] = (tok, now + float(data.get("expires_in", 300)))
+    return tok
+
+
+def _acquire_workload_token(full_scope: str) -> dict:
+    """Keyless: sign an ambient AWS identity proof and exchange it for an auth51
+    token at /workload/aws-token. The issued token is DPoP-bound to our PoP key,
+    so a replayed GetCallerIdentity would yield a token the replayer can't use."""
+    from . import aws, pop  # local imports: keep authority import-light
+
+    cfg = get_config()
+    cnf = pop.jkt() if cfg.pop_enabled else None
+    payload = aws.signed_identity_payload(cnf_jkt=cnf)
+    if payload is None:
+        raise AuthorityError(
+            "no auth51 credentials: set AUTH51_CLIENT_ID/SECRET, or run on a "
+            "registered cloud workload identity (AWS role)."
+        )
+    payload["scope"] = full_scope
+    return _post_json(cfg.authority_url.rstrip("/") + "/v1/workload/aws-token", payload)
+
+
+def mint_intent(
+    *,
+    agent_id: str,
+    checksum: Optional[str],
+    scope: str,
+    audience: str,
+    workflow_id: Optional[str] = None,
+    workflow_step: Optional[dict] = None,
+    delegation_context: Optional[dict] = None,
+    cnf_jkt: Optional[str] = None,
+) -> str:
+    """
+    Mint a scoped, short-lived intent token for one agent action (Hop A).
+    Optional workflow_id/step/delegation_context ride in for provenance (§4.3);
+    workflow_enabled stays False (we don't use the authority's DAG authz path).
+    cnf_jkt binds the token to the caller's ephemeral PoP key (DPoP / RFC 9449).
+    """
+    cfg = get_config()
+    # The OAuth client_credentials token only needs the mint capability
+    # (generate:intent-token). The delegated scope goes in the mint body's
+    # requested_scopes and is governed by the agent GRANT — NOT the OAuth token
+    # (the authority does not require requested ⊆ OAuth scopes; the grant is the
+    # ceiling). Folding the delegated scope into the OAuth request would 400 for
+    # any scope this OAuth client isn't explicitly granted.
+    oauth = get_oauth_token("generate:intent-token")
+    payload = {
+        "grant_type": "agent_checksum",
+        "agent_id": agent_id,
+        "computed_checksum": checksum or "",
+        "requested_scopes": scope.split() if scope else [],
+        "audience": audience,
+        "workflow_enabled": False,
+    }
+    if workflow_id:
+        payload["workflow_id"] = workflow_id
+    if workflow_step:
+        payload["workflow_step"] = workflow_step
+    if delegation_context:
+        payload["delegation_context"] = delegation_context
+    if cnf_jkt:
+        payload["cnf_jkt"] = cnf_jkt
+    mint_url = cfg.authority_url.rstrip("/") + "/v1/intent/token"
+    data = _post_json(mint_url, payload, headers={"authorization": f"Bearer {oauth}"})
+    tok = data.get("access_token")
+    if not tok:
+        raise AuthorityError("intent mint returned no access_token")
+    # Record the exchange for the live viewer (observability). The Authorization
+    # bearer is intentionally omitted (it's a client-credentials secret-equivalent);
+    # the request body + response are the transparency-relevant parts.
+    global _last_mint_exchange
+    _last_mint_exchange = {
+        "request": {"method": "POST", "url": mint_url, "body": payload},
+        "response": data,
+    }
+    return tok
+
+
+_last_mint_exchange: Optional[dict] = None
+
+
+def last_mint_exchange() -> Optional[dict]:
+    """The most recent mint request/response (for the live viewer). Per-process,
+    overwritten each mint; never includes the OAuth bearer."""
+    return _last_mint_exchange
+
+
+_JWT_TOKEN_TYPE = "urn:ietf:params:oauth:token-type:jwt"
+_TOKEN_EXCHANGE_GRANT = "urn:ietf:params:oauth:grant-type:token-exchange"
+
+
+def exchange_token(
+    subject_token: str, *, audience: str, scope: Optional[str] = None
+) -> str:
+    """Hop B (RFC 8693): exchange an intent token (subject) for a downstream
+    token scoped/audienced for the RS. Used at an MCP server's egress. The
+    authority verifies the subject_token against its trusted-issuer config —
+    so the authority must trust its own issuer for self-issued intent tokens.
+    """
+    cfg = get_config()
+    data = {
+        "grant_type": _TOKEN_EXCHANGE_GRANT,
+        "subject_token": subject_token,
+        "subject_token_type": _JWT_TOKEN_TYPE,
+        "audience": audience,
+    }
+    if scope:
+        data["scope"] = scope
+    out = _post_form(cfg.authority_url.rstrip("/") + "/v1/oauth/token", data)
+    tok = out.get("access_token")
+    if not tok:
+        raise AuthorityError("token exchange returned no access_token")
+    return tok
+
+
+def exchange_session(
+    session_token: str,
+    *,
+    audience: str,
+    scope: Optional[str] = None,
+    bind_pop: bool = True,
+) -> str:
+    """Exchange an EXTERNAL session token — issued by the application's own IDP
+    (a trusted issuer registered at the authority: Okta/Auth0/Entra/the legacy
+    patchet IDP/…) — for a sender-constrained auth51 OAuth token (RFC 8693).
+
+    Two properties close the A2 gap (a stolen session token being enough):
+      * we authenticate with the embed's CLIENT credential, so the session token
+        alone cannot be exchanged (the issuer is marked require_client_auth);
+      * the issued token is DPoP-bound to the ephemeral PoP key (cnf.jkt), so it
+        cannot be replayed — the same key then proves possession when this token
+        mints intent tokens.
+    The returned token is the auth51 OAuth token used in place of a raw external
+    session for `generate:intent-token`.
+    """
+    from . import pop  # local import: pop has no dep on authority, avoid cycle
+
+    cfg = get_config()
+    data = {
+        "grant_type": _TOKEN_EXCHANGE_GRANT,
+        "subject_token": session_token,
+        "subject_token_type": _JWT_TOKEN_TYPE,
+        "audience": audience,
+        "client_id": cfg.client_id or "",
+        "client_secret": cfg.client_secret or "",
+    }
+    if scope:
+        data["scope"] = scope
+    if bind_pop:
+        jkt = pop.jkt()
+        if jkt:
+            data["cnf_jkt"] = jkt
+    out = _post_form(cfg.authority_url.rstrip("/") + "/v1/oauth/token", data)
+    tok = out.get("access_token")
+    if not tok:
+        raise AuthorityError("session exchange returned no access_token")
+    return tok