JWT-at-edge auth¶
The edge validates signed JWTs before forwarding to your origin. Failed validations get 401 without ever hitting your origin.
Status: skeleton
Full content lands in a follow-up pass.
Configuration¶
In the portal: Sites → your site → Security tab → JWT-at-edge.
| Field | Value |
|---|---|
| Algorithm | HS256, RS256, ES256, or EdDSA |
| Key | Shared secret (HS256) or public key PEM (asymmetric) |
| Issuer claim required | optional |
| Audience claim required | optional |
| Token location | Authorization: Bearer, cookie name, or query param |
| Routes protected | path prefixes (default: all) |
Why edge auth¶
- Cuts cost: invalid tokens get rejected before reaching your origin (no compute, no bandwidth)
- Cuts latency: legitimate users get a sub-50ms reject path on bad tokens (no origin round trip)
- Hardens against credential stuffing: rate-limit + JWT validation at the edge means abuse never reaches origin
What it doesn't do¶
- It doesn't issue tokens — your application is still the IDP
- It doesn't enforce per-user rate limits — that's the rate-limit feature, separately
- It doesn't decrypt JWE tokens (signed JWS only)