Skip to content

Auth0 decoder adapter

javalin-security-jwt-auth0 provides Auth0JwtDecoder, a JwtDecoder backed by auth0 java-jwt (v4.x) with JWKS support from jwks-rsa.

Installation

Add the adapter alongside javalin-security and the JWT extension. The Auth0 adapter needs two third-party libraries:

implementation("io.github.mzlnk:javalin-security-jwt:0.2.0")
implementation("io.github.mzlnk:javalin-security-jwt-auth0:0.2.0")
implementation("com.auth0:java-jwt:4.+")
implementation("com.auth0:jwks-rsa:0.24.+")

<dependency>
  <groupId>io.github.mzlnk</groupId>
  <artifactId>javalin-security-jwt</artifactId>
  <version>0.2.0</version>
</dependency>
<dependency>
  <groupId>io.github.mzlnk</groupId>
  <artifactId>javalin-security-jwt-auth0</artifactId>
  <version>0.2.0</version>
</dependency>
<dependency>
  <groupId>com.auth0</groupId>
  <artifactId>java-jwt</artifactId>
  <version>[4,5)</version>
</dependency>
<dependency>
  <groupId>com.auth0</groupId>
  <artifactId>jwks-rsa</artifactId>
  <version>[0.24,1)</version>
</dependency>

Neither library is bundled with the adapter. Add java-jwt 4+ and jwks-rsa 0.24+ to your project yourself.

Usage

Auth0JwtDecoder is a stateless singleton — assign it as the decoder:

import io.github.mzlnk.javalin.security.jwt.*
import io.github.mzlnk.javalin.security.jwt.auth0.Auth0JwtDecoder

http.authentication = jwt { jwt ->
    jwt.decoder = Auth0JwtDecoder
    jwt.keySource = JwtKeySource.jwks("https://YOUR_TENANT.auth0.com/.well-known/jwks.json")
    jwt.issuer = "https://YOUR_TENANT.auth0.com/"
    jwt.audiences = setOf("https://my-api.example.com")
}

import io.github.mzlnk.javalin.security.jwt.*;
import io.github.mzlnk.javalin.security.jwt.auth0.Auth0JwtDecoder;

http.authentication = JwtSecurity.jwt(jwt -> {
    jwt.decoder = Auth0JwtDecoder.INSTANCE;
    jwt.keySource = JwtKeySource.jwks("https://YOUR_TENANT.auth0.com/.well-known/jwks.json");
    jwt.issuer = "https://YOUR_TENANT.auth0.com/";
    jwt.audiences = Set.of("https://my-api.example.com");
});

Capabilities

Capability Details
Key sources Public key, PEM, HMAC secret, and JWKS — all of JwtKeySource.
RSA algorithms RS256/384/512, PS256/384/512.
EC algorithms ES256/384/512.
HMAC algorithms HS256/384/512.
JWKS Fetched and cached per URL via jwks-rsa. Key selected by the token's kid.
Claim checks iss, aud, and clock skew for exp / nbf from JwtConfig.