Always set to authorization_code to indicate OAuth 2.0 authorization code grant flow.

The authorization code returned in the authorization grant response.
The provisioned authorization code can only be redeemed once.

The same redirect URL used in the authorization grant request.

The same client ID used in the authorization grant request.

This is always set to urn:ietf:params:oauth:client-assertion-type:jwt-bearer per RFC 7523 JSON Web Token Profile.

Signed Client Assertion Object
A client assertion object in a signed JWT (JWS) compact-serialized format. Refer to RFC 7519 JSON Web Tokens and RFC 7515 JWS compact serialization.
This JWS must be signed by the RP using the private portion of an RSA keypair. The public portion is the one published to the RP's JWKS endpoint and registered with the Hub during onboarding (via the RP's JWKS URL).
A number of parameters need to be included in this JWS and are detailed in the OauthTokenRequestJwtStructure schema.

The PKCE code verifier string that the code_challenge hash was derived from in the authorization grant request