Appearance

API reference@connectum/authDocs 1.3.x

Connectum API Reference / @connectum/auth / SignedTokenIssuer

Interface: SignedTokenIssuer ​

Defined in: packages/auth/src/types.ts:415

Per-issuer JWKS configuration for signedTokenTrust.

The JWKS lookup is issuer-bound: the keyset is selected by the token's iss claim and verification is pinned to that same issuer. This is a hard security requirement — a single shared JWKS holding multiple services' keys does NOT contain compromise (jose resolves the key by kid independently of iss).

Properties ​

algorithms? ​

readonly optional algorithms?: string[]

Defined in: packages/auth/src/types.ts:421

Allowed signing algorithms.

Default ​

ts
["RS256"]

audience? ​

readonly optional audience?: string | string[]

Defined in: packages/auth/src/types.ts:419

Expected audience(s) for tokens from this issuer.

claimsMapping? ​

readonly optional claimsMapping?: object

Defined in: packages/auth/src/types.ts:434

Mapping from token claims to AuthContext fields (dot-notation paths). subject defaults to sub ?? iss; roles/scopes to none unless mapped.

name? ​

readonly optional name?: string

roles? ​

readonly optional roles?: string

scopes? ​

readonly optional scopes?: string

subject? ​

readonly optional subject?: string

jwksUri ​

readonly jwksUri: string

Defined in: packages/auth/src/types.ts:417

The issuer's JWKS endpoint URL (its own keyset only).

maxTokenAge? ​

readonly optional maxTokenAge?: string | number

Defined in: packages/auth/src/types.ts:423

Maximum token age (seconds or string like "2h").

requireExpiration? ​

readonly optional requireExpiration?: boolean

Defined in: packages/auth/src/types.ts:429

Reject a token from this issuer that has no exp claim: a signed token without exp never expires. Set false only for an issuer that cannot add it.

Default ​

ts
true