JWTIdentityProvider

ctrlrun.jwt_identity.JWTIdentityProvider — class, defined at src/ctrlrun/jwt_identity.py:87

class JWTIdentityProvider()
    def __init__(jwks_url: str | None, public_key: str | None, secret: str | None, algorithms: Sequence[str], issuer: str, audience: str, token_type: str | None, header: str, agent_claim: str, user_claim: str | None, claim_names: Sequence[str], leeway: timedelta, jwks_min_refresh_interval: timedelta, http_timeout: timedelta, clock: Callable[[], datetime])

Verify a bearer JWT and map its verified claims onto a Principal (SPEC-v0.3 §3.4). Absent header → None, a decline (§3.2): in-process there are no headers at all, and a provider with nothing to say must not break code that already uses context(). Present and invalid → IdentityError, a refusal, which Control never backfills from. Every configuration mistake that can be caught before a token is seen is caught at construction, because that is the end that can be refused: the token end is already covered by the algorithms allow-list, and a check that only existed there would be a negative test against behaviour the library refuses anyway.

Python API index.
Get started · Why.

Reference

Python API

JWTIdentityProvider

Next

​Next

Next