Validate bearer tokens on a surface

Create a JWT verification strategy

1. In the sidebar, select Credentials, then select the JWT Verification tab. Select Add Strategy.

2. Fill in the strategy fields:

   Field	Required	Description
   Name	Yes	A descriptive label, for example Auth0 production.
   Expected Issuer	Yes	The exact iss claim value the JWT must contain. Must match precisely, including the trailing slash if present.
   JWKS Source	Yes	How the gateway obtains the public keys. Select Remote URL or Static Keys.

3. For the Remote URL option, enter the JWKS URI, for example https://auth.example.com/.well-known/jwks.json. The gateway validates the URI is reachable when you save. A green indicator confirms the URI resolved successfully.

   For the Static Keys option, paste the JWKS JSON directly into the editor. Use this when the identity provider does not expose a JWKS endpoint.

4. Select Create Strategy.

Reference the strategy on a surface

1. Open the surface you want to protect on the canvas.
2. From the left-hand palette, drag a Caller Context element onto the surface and drop it between the Access Point and Managed Agent nodes.
3. Select the Caller Context node to open its config panel.
4. Set Authentication Method to JWT Bearer.
5. Select Configure… to open the full configuration editor.
6. Select your strategy from the JWT Verification Strategy dropdown.
7. Optionally, add Accepted Audiences to restrict which tokens are accepted. Type an audience value and press Enter. The JWT must contain at least one of the accepted values in its aud claim. Leave empty to accept any audience.
8. Close the editor and select the save icon (tooltip: Save changes) on the canvas.

The strategy validates a token when one is present, but a missing or invalid token does not block the request by itself. Add a Policy element in the next step so the surface actually denies those callers.

Deny requests that fail authentication

A missing or invalid bearer token is handed to policy rather than rejected automatically. Add a Policy element so the surface denies a caller whose token did not validate.

1. In the left palette, find the Policy element under the Security & Policy category.

2. Drag Policy onto the canvas and drop it on the same edge as the Caller Context element.

3. Select the Policy node to open its config panel.

4. In Policy Definition, select or create a policy with the following rule.

   package surface.policy
   
   default allow = false
   
   allow if {
     input.source_auth.method == "jwt_bearer"
   }

   This allows the request only when the bearer token validated successfully. Any other outcome, including a missing or invalid token (input.source_auth.method == "failed"), falls through to default allow = false and the request is denied. See OPA policies reference for the full input.source_auth schema.

5. Close the editor and select the save icon (tooltip: Save changes) on the canvas.