import (
	"crypto/ecdsa"
	"crypto/elliptic"
	"crypto/rsa"
	"fmt"
	"time"

	"github.com/golang-jwt/jwt"
	"github.com/google/uuid"
)

func GenerateJWT(clientID string, privateKey interface{}, keyID string) (string, error) {
	now := time.Now()
	claims := jwt.MapClaims{
		"iss": clientID,
		"sub": clientID,
		"aud": "auth.uber.com",
		"jti": uuid.New().String(),
		"iat": now.Unix(),
		"exp": now.Add(15 * time.Minute).Unix(),
	}

	var signingMethod jwt.SigningMethod
	switch key := privateKey.(type) {
	case *rsa.PrivateKey:
		signingMethod = jwt.SigningMethodRS256
	case *ecdsa.PrivateKey:
		if key.Curve != elliptic.P256() {
			return "", fmt.Errorf("unsupported EC curve")
		}
		signingMethod = jwt.SigningMethodES256
	default:
		return "", fmt.Errorf("unsupported private key type")
	}

	token := jwt.NewWithClaims(signingMethod, claims)
	token.Header["kid"] = keyID

	return token.SignedString(privateKey)
}

func LoadPrivateKey(path string) (*rsa.PrivateKey, error) {
	// Implementation to load private key from file
	// ...
}

import com.auth0.jwt.JWT;
import com.auth0.jwt.algorithms.Algorithm;
import java.security.PrivateKey;
import java.security.interfaces.ECPrivateKey;
import java.security.interfaces.RSAPrivateKey;
import java.time.Instant;
import java.util.Date;
import java.util.UUID;

public class JWTGenerator {
    public static String generateJWT(String clientId, PrivateKey privateKey, String keyId) {
        Instant now = Instant.now();
        Algorithm algorithm;
        if (privateKey instanceof RSAPrivateKey) {
            algorithm = Algorithm.RSA256(null, (RSAPrivateKey) privateKey);
        } else if (privateKey instanceof ECPrivateKey) {
            algorithm = Algorithm.ECDSA256(null, (ECPrivateKey) privateKey);
        } else {
            throw new IllegalArgumentException("Unsupported private key type");
        }

        return JWT.create()
                .withKeyId(keyId)
                .withIssuer(clientId)
                .withSubject(clientId)
                .withAudience("auth.uber.com")
                .withJWTId(UUID.randomUUID().toString())
                .withIssuedAt(Date.from(now))
                .withExpiresAt(Date.from(now.plusSeconds(900)))
                .sign(algorithm);
    }

    public static PrivateKey loadPrivateKey(String path) throws Exception {
        // Implementation to load private key from file
        // ...
    }
}

import jwt
import uuid
from datetime import datetime, timedelta

def generate_jwt(client_id, private_key, key_id, algorithm="RS256"):
    now = datetime.utcnow()
    payload = {
        "iss": client_id,
        "sub": client_id,
        "aud": "auth.uber.com",
        "jti": str(uuid.uuid4()),
        "iat": int(now.timestamp()),
        "exp": int((now + timedelta(minutes=15)).timestamp())
    }
    headers = {
        "alg": algorithm,
        "typ": "JWT",
        "kid": key_id
    }
    return jwt.encode(payload, private_key, algorithm=algorithm, headers=headers)

def load_private_key(path):
    # Implementation to load private key from file
    # ...

For ES256, pass an EC P-256 private key and set algorithm="ES256". For RS256, pass an RSA private key and keep algorithm="RS256".

# request
curl -X POST "https://auth.uber.com/oauth/v2/token" \
     -H 'Content-Type: application/x-www-form-urlencoded' \
     --data-urlencode 'grant_type=client_credentials' \
     --data-urlencode 'client_id=${client_id}' \
     --data-urlencode 'scope=${space_delimited_scopes}' \
     --data-urlencode 'client_assertion=${client_assertion_you_generated}' \
     --data-urlencode 'client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer'

# response
{
    "access_token": "${access_token}",
    "token_type": "Bearer",
    "expires_in": "${expires_in_seconds}",
    "scope": "${scopes_you_requested}"
}

firstly call /authorize to get the authorization code

# end user will trigger this request from their browser
https://auth.uber.com/oauth/v2/authorize?client_id=${CLIENT_ID}&response_type=code&redirect_uri=${REDIRECT_URI}&scope=${SPACE_DELIMITED_SCOPES}

# response
HTTP/1.1 302 Found
Location: https://${REDIRECT_URI}?code=${AUTHORIZATION_CODE}

secondly call /token to exchange for access token

# request
curl -X POST "https://auth.uber.com/oauth/v2/token" \
     -H 'Content-Type: application/x-www-form-urlencoded' \
     --data-urlencode 'grant_type=authorization_code' \
     --data-urlencode 'client_id=${CLIENT_ID}' \
     --data-urlencode 'redirect_uri=${REDIRECT_URI}' \
     --data-urlencode 'code=${AUTHORIZATION_CODE_FROM_ABOVE_STEP}' \
     --data-urlencode 'client_assertion=${client_assertion_you_generated}' \
     --data-urlencode 'client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer'

# response
{
    "access_token": "${access_token}",
    "refresh_token": "${refresh_token}",
    "token_type": "Bearer",
    "expires_in": "${expires_in_seconds}",
    "scope": "${scopes_you_requested}"
}

Prerequisite

To integrate with the refresh token flow, you need to obtain refresh token from Authorization Code response

# request
curl -X POST "https://auth.uber.com/oauth/v2/token" \
     -H 'Content-Type: application/x-www-form-urlencoded' \
     --data-urlencode 'grant_type=refresh_token' \
     --data-urlencode 'client_id=${CLIENT_ID}' \
     --data-urlencode 'refresh_token=${refresh_token_value}' \
     --data-urlencode 'client_assertion=${client_assertion_you_generated}' \
     --data-urlencode 'client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer'

# response
{
    "access_token": "${access_token}",
    "refresh_token": "${refresh_token}",
    "token_type": "Bearer",
    "expires_in": "${expires_in_seconds}",
    "scope": "${scopes_you_requested}"
}

# request
curl -X POST "https://auth.uber.com/oauth/v2/token" \
     -H 'Content-Type: application/x-www-form-urlencoded' \
     --data-urlencode 'grant_type=urn:ietf:params:oauth:grant-type:token-exchange' \
     --data-urlencode 'client_id=${CLIENT_ID}' \
     --data-urlencode 'scope=${space_delimited_scopes}' \
     --data-urlencode 'subject_token=${id_token}' \
     --data-urlencode 'subject_token_type=urn:ietf:params:oauth:token-type:id_token' \
     --data-urlencode 'requested_token_type=urn:ietf:params:oauth:token-type:jwt' \
     --data-urlencode 'client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer' \
     --data-urlencode 'client_assertion=${jwt_assertion_you_generated}'

# response
{
    "access_token": "${jwt_token}",
    "token_type": "N_A",
    "issued_token_type": "urn:ietf:params:oauth:token-type:jwt"
}