# CustomJwtConfiguration

Custom JWT authorizer configuration.

Extends: CustomJwtConfiguration
Used as props by: CustomJwtAuthorizer

- Source: [`aws-bedrockagentcore/lib/gateway/inbound-auth/authorizer.ts`](https://github.com/aws/aws-cdk/blob/v2.274.0/packages/aws-cdk-lib/aws-bedrockagentcore/lib/gateway/inbound-auth/authorizer.ts#L44)
- Type last changed: v2.255.0 · 19 May 2026

## Example

```ts
// Create a custom execution role
const executionRole = new iam.Role(this, "GatewayExecutionRole", {
  assumedBy: new iam.ServicePrincipal("bedrock-agentcore.amazonaws.com"),
  managedPolicies: [
    iam.ManagedPolicy.fromAwsManagedPolicyName("AmazonBedrockAgentCoreGatewayExecutionRolePolicy"),
  ],
});

// Create gateway with custom execution role
const gateway = new agentcore.Gateway(this, "MyGateway", {
  gatewayName: "my-gateway",
  description: "Gateway with custom execution role",
  protocolConfiguration: new agentcore.McpProtocolConfiguration({
    instructions: "Use this gateway to connect to external MCP tools",
    searchType: agentcore.McpGatewaySearchType.SEMANTIC,
    supportedVersions: [agentcore.MCPProtocolVersion.MCP_2025_03_26],
  }),
  authorizerConfiguration: agentcore.GatewayAuthorizer.usingCustomJwt({
    discoveryUrl: "https://auth.example.com/.well-known/openid-configuration",
    allowedAudience: ["my-app"],
    allowedClients: ["my-client-id"],
    allowedScopes: ["read", "write"],
  }),
  role: executionRole,
});
```

## Properties

- `allowedAudience`: string[] — Represents individual audience values that are validated in the incoming JWT token validation process.

  **Default:** No audience validation

- `allowedClients`: string[] — Represents individual client IDs that are validated in the incoming JWT token validation process.

  **Default:** No client ID validation

- `allowedScopes`: string[] — Represents individual scopes that are validated in the incoming JWT token validation process.

  **Default:** No scope validation

- `customClaims`: [GatewayCustomClaim](/cdk/api/v2/docs/aws-cdk-lib.aws_bedrockagentcore.GatewayCustomClaim.html)[] — Custom claims for additional JWT token validation.

  **Default:** No custom claim validation

  Allows you to validate additional fields in JWT tokens beyond the standard audience, client, and scope validations.

- `discoveryUrl`: string (required) — This URL is used to fetch OpenID Connect configuration or authorization server metadata for validating incoming tokens.

  Pattern: .+/\.well-known/openid-configuration
  Required: Yes