GetClaims attempts to read the access token and parse jwt.StandardClaims If the access token is not a valid JWT, this will return NotValidJwtTokenErr.

GetCustomClaims attempts to read the access token and parse a custom Claims json If the access token is not a valid JWT, this will return NotValidJwtTokenErr.

JwtTokenExpiresCache keeps a cache of a jwt token Every time Refresh() is called, this cache will only acquire a new access token if: - access token has not been retrieved yet - the access token has expired or close to expiring ExpiresAtThreshold is a duration to configure a token refresh before it's expired A token is considered expired if `time.Now() + ExpiresAtThreshold > Token.ExpiresAt` If ExpiresAtThreshold = 0, will use default of 1s.

Runner provides a mechanism for a runner acquiring an access token from the auth server Refresh acquires.

RunnerAccessTokenSource coordinates a trust relationship between nullstone auth server and a runner The retrieved access token is cached for each org The access token is refreshed if the key has expired or is about to expire.

RunnerKey holds a set of JWT keys that are used to build a trust relationship with the auth server During the registration of a runner, the auth server acquires the JwtPublicKey During requests to gain an access token, the auth server verifies the incoming jwt token against the JwtPublicKey.