Client authentication using client_secret_jwt method

[anuthamako]

Up till the openid-client version 4.5.1, the JWT created for auth assertion, contained "aud" with string value post which it is changed to an object. However the standard documentation states that it should contain the URL
(which I assume is a string). Post the change is made, I am facing 400 Bad request. May I know why was it changed and how can I overcome it?

[panva]

The aud claim being an array is well within spec. You should reach out to the operator of your authorization server to fix their implementation.

Otherwise you may use the clientAssertionPayload extra option on the callback method to pass whatever aud claim value you want.