# JWT Verification Strategies

> Field reference for JWT Verification Strategy configuration, which defines reusable bearer-token validation rules that surfaces reference to authenticate callers.
A JWT Verification Strategy is a named, reusable configuration that tells the gateway which issuer to trust and where to find the public signing keys for bearer token validation.

## Overview

Strategies are managed under Management > Credentials > JWT Verification. A strategy stores the trusted issuer URL and the public signing keys: either fetched from a remote JWKS endpoint or stored statically. Surfaces reference a strategy via the Caller Context element’s JWT Bearer configuration rather than holding issuer details directly.

This separation means that multiple surfaces can share the same issuer configuration and be updated centrally when keys rotate. Changing a strategy’s JWKS URI or static keys takes effect on the next inbound request at every surface that references it.

## Fields

| Field | Type | Required | Default | Description |
| Name | string | Yes | — | Human-readable label. Shown in the JWT Verification Strategy dropdown on the Caller Context configuration panel. |
| Expected issuer | string | Yes | — | The exact value the token’s iss claim must match. Trailing slash differences cause rejection. |
| JWKS source | remote | static | Yes | — | How the gateway obtains public signing keys. |
| JWKS URI | URL | When remote | — | The JWKS endpoint the gateway fetches keys from. Keys are cached according to the server’s Cache-Control headers. The gateway validates the URI is reachable when the strategy is saved. A green indicator on the form confirms the URI resolved successfully. |
| Static JWKS | JSON | When static | — | One or more public keys in JWKS JSON format, stored directly in the strategy. Rotating keys requires updating this field manually. |

## Token validation sequence

For each request at a surface that references a strategy:

- The gateway reads the token from the Authorization: Bearer header.

- The referenced strategy is loaded.

- Signing keys are obtained: fetched from the remote JWKS URI and cached, or read from the static JWKS JSON.

- The token signature is verified against the matching key.

- The token’s iss must equal the strategy’s expected issuer. The token must not be expired.

- If the Caller Context element specifies accepted audiences, the token’s aud claim must contain at least one of them.

- On success, the validated token claims are available to OPA policy evaluation as input.caller.jwt_bearer.

The gateway never defaults to allowing unverified traffic when source authentication is configured. If the remote JWKS endpoint is unreachable at request time, the request fails rather than being accepted.

## Accepted audiences

The Accepted Audiences list is configured on the Caller Context element attached to a surface, not on the strategy itself. A strategy can therefore be shared by surfaces with different audience requirements. Leave the Accepted Audiences list empty on the Caller Context element to accept tokens with any audience.

## Deleting a strategy

Caution

Deleting a strategy immediately breaks any surface whose Caller Context references it. Those surfaces will reject all bearer token requests with 401 Unauthorized until a new strategy is assigned. The dashboard warns before deletion.

## Related

- [Validate bearer tokens on a surface](/products/affinidi-trust-fabric/agent-gateway/how-to-guides/access/validate-bearer-tokens-on-a-surface.md): step-by-step guide to creating a strategy and attaching it to a surface.

- [Use JWT claims to control surface access](/products/affinidi-trust-fabric/agent-gateway/how-to-guides/policies/use-jwt-claims-to-control-access-to-a-surface.md): write OPA Rego rules that use validated JWT claims as enforcement conditions via input.caller.jwt_bearer.

- [Access Point](/products/affinidi-trust-fabric/agent-gateway/reference/surfaces/access-point.md): Access Point field reference, including the Caller Context source authentication options.

- [Credentials](/products/affinidi-trust-fabric/agent-gateway/concepts/credentials.md): conceptual overview of how JWT verification strategies fit the gateway’s credential model.