Authenticate OAuth clients with signed JWTs

OAuth clients can use private_key_jwt to authenticate with a signed client assertion instead of a shared secret. Host the public keys at a jwks_uri, then send a short-lived assertion when calling the token, revocation, or introspection endpoint.

See the Account Chief developer documentation for OAuth integration guidance.