ProjectAuthConfig

Bring-your-own-JWT verification. When present, the realtime edge verifies end-user tokens signed by this issuer against its JWKS, and the environment stops accepting Portal-minted tokens entirely — the block is a switch, not an addition. Accepted signing algorithms are RS256, RS512, and ES256 (RSA moduli must be at least 2048 bits); symmetric algorithms cannot be used, since Portal never holds the signing key. Tokens must carry exp. Clients must also present their publishable key (pk_) on the connection, as that is what identifies which environment's issuer to verify against.

  • claimMap
    Type: object
    required

    Maps claim paths in your token (dot-notation, e.g. public_metadata.role) onto Portal identity fields. userId is REQUIRED and becomes the Portal user id; the optional anon marks the session anonymous when its claim is explicitly true; every other entry becomes a session claim of the same name, readable from ctx.claims in authz and middleware.

    Properties: 1
  • issuer
    Type: string
    required

    The expected iss claim. Tokens from any other issuer are refused.

  • jwksUrl
    Type: stringFormat: uri
    required

    The issuer's JSON Web Key Set. Must use https and resolve to a public host — private, internal, and loopback addresses are rejected at deploy time, and unlike the webhook URL there is no localhost exception, because the edge fetches this from Portal's own egress. Cached for ten minutes, refetched on an unrecognised kid so key rotation needs no deploy.