Guidance on JWT / Bearer usage for external APIs
Hi all, after some tinkering, I have JWT set up within a Nextjs app to use as a bearer token for an external api. The api uses the JWKS endpoint to validate the token. This works fine. I am looking for guidance of best implementation guidelines for security and performance. We heavily use server patterns in Next so we don't rely on nor use
At the moment, if I call
To sum:
- External API that takes a bearer token that should verify against our main Nextjs app via JWKS
- Main Next app uses this external api and must provide a unified JWT bearer token to it
- Other external consumers (eventually) need to use a client credential flow to use the external API with bearer which in turn validates against the main Nextjs app with JWKS
authClientAt the moment, if I call
auth.api.getTokenTo sum:
- External API that takes a bearer token that should verify against our main Nextjs app via JWKS
- Main Next app uses this external api and must provide a unified JWT bearer token to it
- Other external consumers (eventually) need to use a client credential flow to use the external API with bearer which in turn validates against the main Nextjs app with JWKS
