a6-plugin-jwt-auth

Validate JWT tokens for APISIX routes using the a6 CLI.

1|2|Updated Mar 6, 2026
One-click install
npx skills add https://github.com/api7/a6 --skill a6-plugin-jwt-auth-api7
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: a6-plugin-jwt-auth
Source: https://github.com/api7/a6/tree/main/skills/a6-plugin-jwt-auth
Command: npx skills add https://github.com/api7/a6 --skill a6-plugin-jwt-auth-api7

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Authenticate API requests to APISIX by validating JSON Web Tokens (JWT) with the a6 CLI, enabling consistent consumer identity verification across routes and services.

Core Features & Use Cases

  • JWT validation against a configured credential (supporting HS256, RS256, PS256, ES256, and EdDSA)
  • Consumer binding: tie JWT credentials to APISIX consumers for streamlined access control
  • Flexible token lookup: extract tokens from HTTP headers, query parameters, or cookies
  • Claim verification and clock skew tolerance (exp, nbf, and configurable grace period)
  • Key management: provide shared secrets or public keys for asymmetric algorithms, with token enforcement on protected routes
  • Use Case: protect a route behind jwt-auth to ensure only tokens issued by your auth server grant access

Quick Start

Create a consumer, add a jwt-auth credential, attach the plugin to a route, and issue a JWT to test authentication.

Frequently Asked Questions about a6-plugin-jwt-auth

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I validate JWT tokens for APISIX routes using the a6 CLI?

To validate JWT tokens for APISIX, use the a6 CLI to create a consumer, add a jwt-auth credential with a defined key and algorithm, and attach the plugin to your protected route to enforce token-based access control.

Can I extract JWT tokens from cookies or query parameters in APISIX?

Yes, APISIX JWT validation supports flexible token lookup, allowing you to extract tokens from HTTP headers, query parameters, or cookies to verify consumer identity across routes and services.

What JWT signing algorithms are supported for APISIX consumer credentials?

APISIX JWT authentication supports multiple configurable algorithms including HS256, RS256, PS256, ES256, and EdDSA. You can use shared secrets for symmetric algorithms or public keys for asymmetric ones.

Does APISIX JWT validation handle token expiration and clock skew?

Yes, APISIX JWT validation includes claim verification for exp and nbf claims, and supports a configurable grace period to tolerate clock skew when validating signed tokens for API requests.

Why do I need to bind JWT credentials to APISIX consumers?

Binding JWT credentials to APISIX consumers enforces credential binding, ensuring streamlined access control and that only tokens issued by your auth server grant access to protected routes.