Context provided by the SDK when calling CredentialProvider.authenticate.
Contains optional parameters the SDK generates internally (e.g., DPoP fingerprint) that the implementor can forward to their server-side token endpoint.
JWK Thumbprint (RFC 7638) of the SDK’s ephemeral DPoP key pair. When present, the implementor should forward this value as the fingerprint parameter to the server-side SAT issuance endpoint alongside scope: "sat:refresh". This enables the server to bind the SAT to the SDK’s key pair, allowing automatic Client Bound SAT refresh without developer intervention. When absent (e.g., Web Crypto API not available), the implementor should proceed without DPoP binding.