Pre-rewrite scenario. This walkthrough was written against an earlier draft of draft-hardt-aauth-bootstrap. As of -01 the document is informational AP-side enrollment guidance; the PS /bootstrap endpoint, bootstrap_token, and aa-bootstrap+jwthave been removed. PS-binding now happens lazily on the agent's first interaction with the PS. See the bootstrap overview for current framing.
Token Renewal — Mobile (jkt-jwt)
After an agent token expires, the mobile agent renews without re-involving the PS. The durable enclave key (Secure Enclave on iOS, StrongBox on Android) signs a jkt-jwt that chains to a newly generated ephemeral key. The agent provider verifies the enclave signature, looks up the existing binding by key thumbprint, and issues a fresh agent token — no browser, no PS redirect.
Agent generates a fresh Ed25519 signing key pair in memory.
This new ephemeral key will replace the one bound in the expiring agent token.
The old ephemeral key is kept alive only until the new agent token is received.
Step 1: Generate new ephemeral key
No headers