> ## Documentation Index
> Fetch the complete documentation index at: https://docs.alumio.com/llms.txt
> Use this file to discover all available pages before exploring further.

# JWT authentication

> Use a JWT header and payload for request authentication.

Signs each request with a JSON Web Token (JWT) and sends it in the `Authorization: Bearer` header. Use this for services that expect a freshly signed JWT on every call. You provide the signing method, the key, and the token's headers and payload; Alumio builds and signs the token for you, filling in the standard `typ` and `alg` header values and the issued-at (`iat`) and expiry (`exp`) timestamps automatically.

This documentation describes: [Schema](/schemas/http-authentication-configurator/jwt)

## Fields

**Encryption Method**

Required

The signing algorithm to use. Choose from **HS256** (shared secret), **RS256 (RSA Key)**, **RS256 (Passphrase)**, or **EdSDA (Ed25519)**. Defaults to **HS256**. Your choice determines what to enter in the key field below.

**JWT encryption key**

Required

The key used to sign the token. For **HS256** this is your shared secret; for **RS256 (RSA Key)** it becomes a multi-line **Private key** field where you paste the full key including the `-----BEGIN PRIVATE KEY-----` and `-----END PRIVATE KEY-----` lines. You can store the value in an environment variable and reference it here.

**Expire time in seconds**

Required

How long the token stays valid, in seconds. Alumio uses this to set the token's expiry timestamp on each request. Defaults to `3600` (one hour).

**JWT Headers**

Required

The token header, entered as JSON. The `typ` and `alg` values are set for you, so you only add any extra headers the service requires (for example a key id). Use an empty object `{}` when no extra headers are needed.

**JWT Payload**

Required

The token payload (its claims), entered as JSON. The issued-at (`iat`) and expiry (`exp`) values are set for you; add the claims the service expects, such as an issuer or subject.

## Sample data

This feature configures a connection rather than transforming data, so there is no before/after to show. A typical HS256 setup looks like this:

| Field | Value |
| - | - |
| Encryption Method | `HS256` |
| JWT encryption key | `your-signing-secret` |
| Expire time in seconds | `3600` |
| JWT Headers | `{}` |
| JWT Payload | `{ "iss": "your-app", "sub": "service-account" }` |

```json Configuration theme={null}
{
  "prototype": "jwt",
  "parameters": {
    "encryptionProtocol": "HS256",
    "key": "your-signing-secret",
    "expireTime": 3600,
    "headers": {},
    "payload": {
      "iss": "your-app",
      "sub": "service-account"
    }
  }
}
```


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.