jwt

Builds an AuthenticationStrategy.Sync for JWT bearer-token authentication, and returns it for assignment to http.authentication or ws.authentication.

Accepts a JwtConfig consumer; JwtConfig.decoder and JwtConfig.keySource are required. By default handlers see the built-in Jwt identity; set JwtConfig.identityMapper to map verified tokens to your own domain io.github.mzlnk.javalin.security.authentication.Identity instead. Roles always come from JwtConfig.rolesMapper. Browser WebSocket clients cannot set an Authorization header on the handshake — use TokenResolver.cookie and pair with ws.allowedOrigins when authenticating via cookie.