To validate an identity-provider-issued JWT before an API request reaches your upstream service, configure Kong Gateway’s OpenID Connect (OIDC) plugin with auth_methods: bearer. In this plugin, bearer is the stateless JWT access-token mode: Kong obtains the provider’s public keys, verifies the token signature, and checks standard claims such as expiration. This is distinct from Kong’s standalone JWT plugin, which uses a Consumer-oriented credential model.
What Kong’s OIDC plugin does
Kong describes OpenID Connect as a standard built on OAuth and JWT that connects Kong Gateway to an identity provider (IdP) for authentication and authorization. The OIDC plugin can act as an OAuth 2.0 resource server and an OpenID Connect relying party between the client and an upstream service. That lets the gateway handle authentication before proxying a request, rather than requiring the upstream application to contain the IdP integration. See Kong’s OpenID Connect plugin documentation and OIDC overview.
For JWT access-token validation, the plugin’s stateless mode is named bearer for legacy reasons. Kong uses public keys published by the configured IdP to validate the token signature, then checks standard claims such as exp. This is local validation of the presented token, not a call to the IdP to ask whether the token is currently active.
Choose the flow that matches the caller
JWT validation is one option in Kong’s OIDC plugin, not a universal authentication flow. Decide how the client obtains its credential and whether your API needs local token checks or an IdP lookup. Kong documents authorization code, session authentication, client credentials, JWT access-token authentication, Kong OAuth tokens, introspection, user info, refresh tokens, password grant, and token exchange; supported options and exact setup depend on the current plugin documentation and deployment.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall| Caller or situation | Flow to consider | Validation path |
|---|---|---|
| Browser or other user-facing client signing a user in | Authorization code; examine PKCE for the client architecture | Choose the plugin’s authentication behavior to match the sign-in flow; it is not automatically the same as validating an already-issued bearer JWT. |
| Service calling another service | Client credentials | The client obtains a token for its service identity; configure the IdP client and Kong flow accordingly. |
| Client already presents an IdP-issued JWT access token | OIDC plugin bearer |
Kong validates the signature using IdP-published public keys and checks standard claims locally. |
| API must ask the IdP whether a token is active | Introspection | Kong sends the token to the IdP’s introspection endpoint rather than relying only on local JWT verification. |
Kong identifies authorization code as one of the most common OIDC workflows, but does not prescribe one flow for every deployment. Its provider examples include Keycloak, Auth0, Amazon Cognito, Azure AD, Curity, Google, and Okta; these are documented integration examples, not a ranking or a guarantee that every provider’s client settings are identical. Review Kong’s plugin documentation and OIDC overview for your provider and selected flow.
Do not confuse OIDC bearer mode with Kong’s JWT plugin
The similarly named plugins solve related but different integration problems. Use the OIDC plugin’s bearer method when Kong should validate access tokens issued by an IdP using that provider’s published keys. The standalone JWT plugin associates JWT credentials with Kong Consumers and documents HS256 and RS256 signature verification, as well as checks for exp and nbf. Do not copy its Consumer credential setup as though it were the OIDC plugin’s bearer configuration. Compare Kong’s OIDC plugin documentation with its standalone JWT plugin documentation.
Rank #2
Configure JWT access-token authentication
Kong’s how-to guide describes configuring an issuer, client ID, client secret, and client-authentication settings, then enabling the OIDC plugin with auth_methods: bearer and associating it with a service. The guide states a minimum Kong Gateway version of 3.4. Confirm your Gateway version, deployment topology, and current plugin configuration reference before adapting the example; configuration support can vary by version and deployment.
- Confirm the identity-provider details. Obtain the issuer URL and the client ID and secret required by the selected flow. Check the provider’s client-authentication requirements and ensure the issuer is the one that issued the access tokens your API will receive.
- Configure the OIDC plugin. Follow Kong’s Configure OpenID Connect with JWT authentication guide for the current syntax. Set the issuer and client details, select the client-authentication method, and include
bearerinauth_methods. - Attach the plugin to the API service. Apply the plugin to the Kong service that fronts the intended upstream API, following the guide’s service-association example.
- Send the token in the request header. Test with an access token in the standard
Authorization: Bearer <token>header. Kong’s example also permits a query-string token for demonstration; prefer the header for ordinary API use because tokens in URLs can be exposed in browser history, logs, and other URL records. - Check the outcome at the gateway and upstream. Verify that a valid token is accepted and that an invalid or expired token is rejected before the upstream receives the request. Also confirm that requests are reaching the intended Kong service and that the issuer, token, and provider configuration correspond.
Kong’s guide uses client_secret_post to make testing the IdP connection easy. Kong explicitly recommends using a more secure supported client-authentication method in production. Select a method supported by both your IdP and Kong configuration rather than carrying the testing setting into production by default. See the Kong JWT authentication how-to.
Discovery, key retrieval, and caching
When configured with an issuer, the OIDC plugin automatically retrieves provider discovery metadata. The discovery cache includes discovery endpoints, JWKS keys, and the token endpoint. Kong documents a default config.cache_ttl of 3600 seconds. Treat that as the documented default, not a promise that every deployment uses it: check the live configuration reference and your own effective plugin settings.
If required discovery information is missing, Kong can attempt rediscovery. Kong’s documentation says that when rediscovery fails with a non-2xx response, the plugin can fall back to sufficient discovery data still in cache. This behavior makes cache state relevant to troubleshooting, but it does not replace checking issuer reachability, provider metadata, and key availability. See Kong’s OIDC plugin cache documentation.
Quick Recap
Best Value
Implementation checks before production
- Use the intended plugin and mode: IdP-issued JWT access token validation belongs to OIDC
bearermode; Consumer-associated credentials belong to the separate JWT plugin. - Match issuer and audience expectations: confirm the token is from the intended provider and is meant for the API, using the provider and plugin configuration applicable to your setup.
- Keep credentials out of URLs: use the bearer authorization header for routine API requests rather than query-string tokens.
- Choose client authentication deliberately: avoid leaving Kong’s easy-to-test
client_secret_postsetting in production without validating that choice against supported, more secure alternatives. - Check version and deployment: the how-to’s stated minimum is Gateway 3.4; verify the current plugin docs for your actual version and topology.
- Test failure paths: include expired or invalid tokens, unavailable discovery data, and key/discovery cache behavior in deployment validation.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
