JWT authentication

Require a valid JSON Web Token. Verify with a shared secret (HS*), a public key, or a JWKS endpoint.

Type	jwtAuth
Category	Access

Fields

Field	Type	Required	Default	Description
secret	text	no	—	Shared secret for HMAC algorithms (HS256/384/512). Secret — encrypted at rest, never returned by the API.
publicKey	text	no	—	PEM public key for asymmetric algorithms (RS*/ES*).
jwksUrl	text	no	—	Endpoint serving the signing keys.
jwksFile	text	no	—	Path to a local JWKS file.
algorithms	list of text	no	—	Accepted signing algorithms. Empty uses a safe set for the key type you configured. Example: RS256.
issuer	text	no	—	Required iss claim.
audience	text	no	—	Required aud claim.
claimsExpression	text	no	—	Expression the token claims must satisfy, e.g. OneOf('role', 'admin', 'ops'). Example: Equals('email_verified', true).
forwardAuthorization	true/false	no	—	Pass the original Authorization header on to the app instead of stripping it.
forwardHeaders	key/value map	no	—	Deprecated: use "Send identity to the app" below. Each row sends one claim from the verified token to your app as a request header.
forward	group	no	—	Send identity to the app.

forward

Field	Type	Required	Default	Description
headers	key/value map	no	—	Dot notation reaches nested claims (user.role); booleans arrive as "true"/"false", and a claim the token does not carry is skipped rather than sent empty.
query	key/value map	no	—	Claims as query parameters.
cookies	key/value map	no	—	Claims as cookies.
stripInbound	true/false	no	true	Leave on. Off lets a caller send these headers itself and choose who your app thinks it is.
arraySeparator	text	no	—	Array separator. Example: ,.
encoding	one of auto, raw	no	—	Encoding.
maxValueBytes	number	no	—	Maximum value size. Example: 4096.

Secret fields

Fields marked secret are encrypted at rest and never returned by the API. Editing the middleware leaves a stored secret in place unless you type a new value — an empty box means "keep what is stored", not "clear it".