JWT Bearer Authentication

This authentication scheme expects incoming requests to have an JWT Bearer token in their Authorization header.The header should be similar to this example:

Authorization: Bearer <secret token>

Configuration

Name	Supports References	Description
Audience	yes	If provided, JWT tokens must contain this value as its aud claim to be considered valid.
Issuer	yes	If provided, JWT tokens must contain this value as its iss claim to be considered valid.
Validate Lifetime	no	Whether the iat (issued at) and nbf (not before) claims should be validated.
Signing Key Type	no	If a signing key should be used to validate the authenticity of the JWT token. Signing key validation of either type is recommended.
Signing Key	yes	The signing key the used to validate the signature of the token. See below for the requirements of the signing key, depending on the selected Key Type
Signing Key Format	No	The format of the signing key. See Signing Key Types below for the formats supported for each type.

Signing Key Types

Key Type	Requirements
Symmetric	The key used by the request sender to sign the JWT token. Can be provided in base64 or UTF8 encoding.NOTE: Only symmetric keys meeting the recommended minimum length for the signing algorithm are supported (ie 256 bits/32 bytes for HmacSha256, 384 bits/48 byts for HmacSha384, 512 bits/64 bytes for HmacSha512, etc). JWT tokens signed with a symmetric key that does not meet this requirement will not be considered valid.
Asymmetric	The RSA public key, corresponding to the private key used to sign the JWT token by the sender. Must be provided as either an X509 SubjectPublicKey or a PKCS#1 RSAPublicKey, with or without PEM headers.