CustomJWTAuthorizerConfiguration

Configuration for a custom JWT authorizer that validates inbound bearer tokens against an OpenID Connect identity provider.

discoveryUrl

The OpenID Connect discovery URL used to retrieve the identity provider's metadata and signing keys.

Type: String

Length Constraints: Minimum length of 1. Maximum length of 2048.

Pattern: .+/\.well-known/openid-configuration

Required: Yes

allowedAudience

The audience values accepted during JWT validation. A token is rejected if none of its audience claims match.

Type: Array of strings

Array Members: Minimum number of 1 item.

Length Constraints: Minimum length of 1. Maximum length of 255.

Required: No

allowedClients

The client identifiers accepted during JWT validation. A token is rejected if it was not issued to one of these clients.

Type: Array of strings

Array Members: Minimum number of 1 item.

Length Constraints: Minimum length of 1. Maximum length of 255.

Required: No

allowedScopes

The scopes accepted during JWT validation. A token is rejected if it does not carry one of these scopes.

Type: Array of strings

Array Members: Minimum number of 1 item.

Length Constraints: Minimum length of 1. Maximum length of 255.

Pattern: [\x21\x23-\x5B\x5D-\x7E]+

Required: No

customClaims

Additional custom claim validations applied to the inbound JWT.

Array Members: Minimum number of 1 item.

Required: No

privateEndpoint

The private endpoint used to reach the identity provider's discovery URL over a private network path.

Note: This object is a Union. Only one member of this object can be specified or returned.

Required: No

privateEndpointOverrides

Per-domain private endpoint overrides that route specific identity provider domains through distinct private endpoints.

Array Members: Minimum number of 0 items. Maximum number of 5 items.

Required: No

Contents