> ## Documentation Index
> Fetch the complete documentation index at: https://tyk.io/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# JWT Quick Start: Securing APIs with Auth0, Descope or Keycloak

> Learn how to secure your Tyk OAS APIs using JWT authentication with Auth0, Descope or Keycloak as identity providers.

In this tutorial, we'll secure a Tyk OAS API using JWT authentication with Auth0, Descope or Keycloak as the identity provider.

> [!NOTE]
>
> If you want to try out JWT Auth without linking up to a third-party IdP then you can skip step 1 and provide the base64 encoded public key for your JWT (in the `source` field rather than configuring `jwksURIs`) in step 3. You'll need to generate a JWT for the request, but otherwise everything stays the same.
>
> Now back to the tutorial...

We'll start by configuring the identity provider, then set up JWT validation in Tyk, create a security policy, configure the API to use the policy, and finally test the secured API with a valid token.

### Prerequisites

* A Tyk installation (Cloud or Self-Managed) with Tyk Dashboard license
* An Auth0 account, a Descope project, or a Keycloak installation
* An existing Tyk OAS API (see [this tutorial](https://tyk.io/docs/api-management/gateway-config-managing-oas.md#using-tyk-dashboard-api-designer-to-create-an-api))
* Postman, cURL, or another API testing tool

### Step-by-Step Guide

1. **Configure Your Identity Provider to obtain your JWKS URI**

   The first step is to configure your Identity Provider (IdP) to issue JWTs and provide a JWKS URI that Tyk can use to validate the tokens. Below are instructions for both Auth0 and Keycloak.

   > [tab] Auth0 Setup
   >
   > 1. Log in to your Auth0 dashboard
   > 2. Navigate to Applications > APIs and click Create API
   > 3. Enter a name and identifier (audience) for your API
   > 4. Note your Auth0 domain (e.g. `your-tenant.auth0.com`)
   > 5. Your JWKS URI will be: `https://your-tenant.auth0.com/.well-known/jwks.json`

   > [tab] Descope Setup
   >
   > Descope issues JWTs through **[Inbound Apps](https://docs.descope.com/identity-federation/inbound-apps)**, its OAuth 2.0 authorization server. The signing keys are published per project rather than per application, so every Inbound App in a project shares one JWKS URI.
   >
   > 1. Log in to the [Descope Console](https://app.descope.com)
   > 2. Navigate to **Inbound Apps** and create an app, or select an existing one
   > 3. Note your **Project ID**, shown in the Connection Information section alongside the client ID and discovery URL
   > 4. Your JWKS URI will be: `https://api.descope.com/<project-id>/.well-known/jwks.json`
   > 5. Your issuer will be: `https://api.descope.com/v1/apps/<project-id>`
   >
   > Substitute your regional or custom base URL for `api.descope.com` if you use one.
   >
   > Descope signs with RS256, so select **RSA Public Key** as the token signing method in step 3. Granted scopes arrive in the `scope` claim as a space-delimited string.

   > [tab] Keycloak Setup
   >
   > 1. Log in to your Keycloak admin console
   > 2. Create or select a realm (e.g. `tyk-demo`)
   > 3. Navigate to Clients and create a new client with:
   >    * Client ID: `tyk-api-client`
   >    * Client Protocol: `openid-connect`
   >    * Access Type: `confidential`
   > 4. After saving, go to the Installation tab and select "OIDC JSON" format
   > 5. Your JWKS URI will be: `http://your-keycloak-host/realms/tyk-demo/protocol/openid-connect/certs`

2. **Create a Security Policy**

   1. In the Tyk Dashboard, navigate to **Policies**
   2. Click **Add Policy**
   3. Configure the policy:
      * Name: `JWT Auth Policy`
      * APIs: Select your Tyk OAS API
      * Access Rights: Configure appropriate paths and methods
      * Authentication: Select JWT
      * JWT Scope Claim Name: Enter the JWT claim that contains scopes (e.g. `scope` or `permissions`)
      * Required Scopes: Add any required scopes for access (optional)
   4. Click Create to save your policy

3. **Configure JWT Authentication in Tyk OAS API**

   1. Navigate to APIs and select your API
   2. Click **Edit**
   3. Enable **Authentication** in the **Server** section, select **JSON Web Token (JWT)** as the authentication method
   4. Configure the JWT settings:
      * Token Signing Method: Select `RSA Public Key`
      * Subject identity claim: Set to `sub`
      * JWKS Endpoint: Enter your JWKS URI for your IdP obtained in step 1
      * Policy claim: Set to `pol`
      * Default policy: Select `JWT Auth Policy` (the policy you created previously)
      * Clock Skew (optional): Set to accommodate time differences (e.g. `10`)
      * Authentication Token Location: `header`
      * Header Name: `Authorization`
      * Strip Authorization Data: `Enabled`
   5. Click **Save API**

4. **Test your API**

   1. Obtain a JWT from your IdP
   2. Make a request to your API providing the JWT as a Bearer token in the `Authorization` header; Tyk will validate the JWT using the JWKS that it retrieves from your JWKS URI
   3. Observe that the request is successful

   ```bash theme={null}
       curl -X GET {API URL}  -H "Accept: application/json" -H "Authorization: Bearer {token}"
   ```