JWT verification settings
Instance-wide policy for JWT verification: the operator’s egress rules for fetching keys. Per-issuer settings — algorithms, issuer, audience, leeway, the JWKS URL — belong to the channel’s auth block or the jwt_verify task. Each of those describes one issuer relationship.
Synopsis
[jwt]
allow_private_jwks_urls = false
Options
| Setting | Default | Env var | When to change |
|---|---|---|---|
jwt.allow_private_jwks_urls | false | ORION_JWT__ALLOW_PRIVATE_JWKS_URLS | Turn on for an issuer on a private address (an in-cluster Keycloak, a sidecar). |
jwks_url is authored input: a field of a channel’s auth block or of a jwt_verify task. It is the one egress path in the runtime with no operator-configured connector behind it. So it is checked twice. The URL must be https:// where it is authored. The address it resolves to is checked on every fetch, exactly as an http connector without allow_private_urls is. The split is deliberate. An admin API that resolves DNS before accepting a channel is an admin API that hangs when the issuer is down. A host that was public when the channel was stored can be private by the time it is dialled.
Setting this to true disables the address check for every JWKS fetch on the instance. It is instance-wide rather than per channel. A per-channel opt-out would let the author of a definition grant themselves the egress the setting exists to gate.
Related
- Channel configuration ›
auth: the per-issuer settings of thejwtmode. jwt_verify: verification inside a workflow.- Secure an instance: egress policy in context.
- Server configuration: every section, by what you are configuring.
Last verified 14 September 2026