> **Experimental**
>
> `@aws-cdk/aws-bedrock-agentcore-alpha` is an [**experimental**](/stability) (alpha) package: its API may change in any release, without a major version bump.
# CustomJwtConfiguration

Custom JWT authorizer configuration.

Extends: CustomJwtConfiguration
Used as props by: CustomJwtAuthorizer

- Source: [`lib/gateway/inbound-auth/authorizer.ts`](https://github.com/aws/aws-cdk/blob/v2.275.0-alpha.0/packages/@aws-cdk/aws-bedrock-agentcore-alpha/lib/gateway/inbound-auth/authorizer.ts#L47)

## Example

```ts
// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import * as bedrock_agentcore_alpha from '@aws-cdk/aws-bedrock-agentcore-alpha';

declare const gatewayCustomClaim: bedrock_agentcore_alpha.GatewayCustomClaim;
const customJwtConfiguration: bedrock_agentcore_alpha.CustomJwtConfiguration = {
  discoveryUrl: 'discoveryUrl',

  // the properties below are optional
  allowedAudience: ['allowedAudience'],
  allowedClients: ['allowedClients'],
  allowedScopes: ['allowedScopes'],
  customClaims: [gatewayCustomClaim],
};
```

## Properties

- `allowedAudience`: string[] — Represents individual audience values that are validated in the incoming JWT token validation process.

  **Default:** No audience validation

- `allowedClients`: string[] — Represents individual client IDs that are validated in the incoming JWT token validation process.

  **Default:** No client ID validation

- `allowedScopes`: string[] — Represents individual scopes that are validated in the incoming JWT token validation process.

  **Default:** No scope validation

- `customClaims`: [GatewayCustomClaim](/cdk/api/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.GatewayCustomClaim.html)[] — Custom claims for additional JWT token validation.

  **Default:** No custom claim validation

  Allows you to validate additional fields in JWT tokens beyond the standard audience, client, and scope validations.

- `discoveryUrl`: string (required) — This URL is used to fetch OpenID Connect configuration or authorization server metadata for validating incoming tokens.

  Pattern: .+/\.well-known/openid-configuration
  Required: Yes