Builder

The audience values accepted during JWT validation. A token is rejected if none of its audience claims match.

The client identifiers accepted during JWT validation. A token is rejected if it was not issued to one of these clients.

The scopes accepted during JWT validation. A token is rejected if it does not carry one of these scopes.

Additional custom claim validations applied to the inbound JWT.

The OpenID Connect discovery URL used to retrieve the identity provider's metadata and signing keys.

The private endpoint used to reach the identity provider's discovery URL over a private network path.

Per-domain private endpoint overrides that route specific identity provider domains through distinct private endpoints.