/** Supplies a fresh external identity token for an OpenAI workload-identity exchange. */
export interface SubjectTokenProvider {
    /** Whether the provider returns a signed JWT or an OpenID Connect identity token. */
    tokenType: 'jwt' | 'id';
    /** Returns a fresh subject token whenever the SDK needs to exchange or refresh its access token. */
    getToken: () => Promise<string>;
}
/** Configures federation from an external workload identity into an OpenAI service account. */
export interface WorkloadIdentity {
    /** Optional OAuth client identifier included in the token-exchange request. */
    clientId?: string;
    /** Identifier of the OpenAI identity-provider resource that trusts the external workload. */
    identityProviderId: string;
    /** Identifier of the OpenAI service account that receives the verified external identity. */
    serviceAccountId: string;
    /** Provider that obtains the external subject token for each token exchange. */
    provider: SubjectTokenProvider;
    /** Seconds before expiration when access-token refresh begins; defaults to 1,200 seconds. */
    refreshBufferSeconds?: number;
}
/** OAuth token-exchange response returned by the OpenAI workload-identity endpoint. */
export interface TokenExchangeResponse {
    /** OpenAI access token to use as the request's bearer credential. */
    access_token: string;
    /** OAuth token-type URN describing the issued access token. */
    issued_token_type: string;
    /** Authorization scheme associated with the access token, normally `Bearer`. */
    token_type: string;
    /** Token lifetime in seconds; the SDK assumes 3,600 seconds when omitted. */
    expires_in?: number;
}
//# sourceMappingURL=types.d.ts.map