> ## Documentation Index
> Fetch the complete documentation index at: https://redop.useagents.site/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# JWT Authentication

> Validate bearer JWTs with the built-in jwt plugin.

Use `jwt(...)` when your clients already send bearer tokens and you want Redop to verify them on each HTTP request.

## Shared secret example

```ts theme={null}
import { jwt, Redop } from "@redopjs/redop";

new Redop({ serverInfo: { name: "jwt-demo" } }).use(
  jwt({
    secret: process.env.JWT_SECRET ?? "dev-jwt-secret",
    issuer: "https://auth.example.com",
    audience: "my-mcp-server",
  }),
);
```

## JWKS example

```ts theme={null}
new Redop({ serverInfo: { name: "jwt-demo" } }).use(
  jwt({
    jwksUri: "https://auth.example.com/.well-known/jwks.json",
    issuer: "https://auth.example.com",
    audience: "my-mcp-server",
  }),
);
```

## MCP OAuth challenge (Claude / connectors)

Set `resource` to the public MCP URL. Redop then serves Protected Resource Metadata and returns HTTP 401 challenges:

```ts theme={null}
new Redop({ serverInfo: { name: "jwt-demo" } }).use(
  jwt({
    jwksUri: "https://your-app.clerk.accounts.dev/.well-known/jwks.json",
    issuer: "https://your-app.clerk.accounts.dev",
    resource: "https://mcp.example.com/mcp",
    audience: "https://mcp.example.com/mcp",
  }),
);
```

## Optional auth

```ts theme={null}
new Redop({ serverInfo: { name: "jwt-demo" } }).use(
  jwt({
    secret: process.env.JWT_SECRET ?? "dev-jwt-secret",
    optional: true,
  }),
);
```

## See also

* [API key authentication](/docs/guides/authentication/api-key)
* [OAuth authentication](/docs/guides/authentication/oauth)
* [Built-in plugins reference](/docs/reference/built-in-plugins)