JWT

The JWT Policy helps you to validate JSON Web Tokens (JWT) by providing a signing key or a JSON Web Key Set (JWK(S)). You can also require claims and strip them to forward them as header to the backend API.

If you are using the JWT or Keycloak OAuth policy, an authentication dialog is shown in the API Developer Portal that you need to use to consume the API. To support you during testing, API Management provides the default user token, if you leave the authentication dialog empty. If you make your own entries in the dialog, these are used in preference to the default. Refer to Testing APIs for details.

Configuration Options

Basic Configuration

Option	Description	Possible Values	Default
Signing Key or URL to a JWK(S)	Specify a Base-64 encoded signing key or a URL to a JWK(S) to validate JWT. Self-signed certificates are currently not supported.	a Base-64 encoded string or a URL to a JWK(S)	FQDN path automatically set for your PAS installation
Key ID (kid) of JWK(S)	Specify the key id of the JWK(S) in this field if you provided a JWK(S) URL. If no value is provided, the policy tries to look up the key ID from the token header and tries to fetch the corresponding certificate from the configured JWKS endpoint.	a valid string	-

Required Claims

All standard claims, custom claims and ID token fields are available (case sensitive). A special value of access_token will forward the entire encoded token. Nested claims can be accessed by using the JavaScript dot syntax (e.g: address.country, address.formatted).

Option	Description	Possible Values	Default
Claim	Specify a list of required claims. If a required claim is not present, access will be rejected.	a string	-
Value	Determines the content of the claim.	a string	-
Click Add to create more rows in the table. Click Delete to remove selected rows.

Forward Claim Information

Fields from the JWT can be set as headers and forwarded to the API. All standard claims, custom claims and ID token fields are available (case sensitive). A special value of access_token will forward the entire encoded token. Nested claims can be accessed by using the JavaScript dot syntax (e.g: address.country, address.formatted).

Option	Description	Possible Values	Default
Field	Specify a list of fields from the JWT to be forwarded to the API as a header.	a string	-
Header	Holds the value of the Field.	a string	-
Click Add to create more rows in the table. Click Delete to remove selected rows.

Advanced Configuration

Option	Description	Possible Values	Default
Require Signed JWT (JWS)	Specify whether JWTs must be cryptographically signed and verified (JWS). It is stongly recommended to enable this option.	enabled disabled	enabled
Strip Tokens	Enable if the Authorization header or token query parameter should be removed before forwarding traffic to the API.	enabled disabled	disabled
Maximum Clock Skew	Specify the maximum allowed clock skew in seconds when validating exp (expiry) and nbf (not before) claims. 0 implies default behavior.	a valid integer	0

Related Pages:

Policies
- Attaching Policies