#### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index')
### [Abblix\.Oidc\.Server\.Common\.Configuration](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration 'Abblix\.Oidc\.Server\.Common\.Configuration')

## JwtBearerOptions Class

Configuration options for JWT Bearer grant type \(RFC 7523\)\.
Defines trusted external identity providers whose JWT assertions can be exchanged for access tokens\.

```csharp
public record JwtBearerOptions : System.IEquatable<Abblix.Oidc.Server.Common.Configuration.JwtBearerOptions>
```

Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → JwtBearerOptions

Implements [System\.IEquatable&lt;](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[JwtBearerOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.JwtBearerOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.JwtBearerOptions')[&gt;](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')
### Properties

## JwtBearerOptions\.AllowedTokenTypes Property {#Abblix.Oidc.Server.Common.Configuration.JwtBearerOptions.AllowedTokenTypes}

Allowed values for the 'typ' \(type\) header in JWT assertions\.
When not empty, JWTs must have a typ header matching one of these values\.
Common values include "JWT" and "at\+jwt"\.
Default is empty \(typ header validation disabled\)\.

```csharp
public string[] AllowedTokenTypes { get; set; }
```

#### Property Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array')

### Remarks
While RFC 7523 does not mandate typ header validation, validating it prevents token confusion attacks
in multi\-token environments where different token types \(access tokens, ID tokens, assertions\) may coexist\.
Set to \["JWT"\] or \["at\+jwt"\] based on your token ecosystem requirements\.

## JwtBearerOptions\.ClockSkew Property {#Abblix.Oidc.Server.Common.Configuration.JwtBearerOptions.ClockSkew}

The clock skew tolerance for JWT validation\.
Allows for small differences in clock times between the JWT issuer and this server\.
Default is 5 minutes, as recommended by RFC 7523 Section 3\.

```csharp
public System.TimeSpan ClockSkew { get; set; }
```

#### Property Value
[System\.TimeSpan](https://learn.microsoft.com/en-us/dotnet/api/system.timespan 'System\.TimeSpan')

## JwtBearerOptions\.JwksCacheDuration Property {#Abblix.Oidc.Server.Common.Configuration.JwtBearerOptions.JwksCacheDuration}

The duration for which JWKS \(JSON Web Key Sets\) are cached before being refreshed\.
Reduces network calls and improves performance while ensuring keys are periodically updated\.
Default is 1 hour\.

```csharp
public System.TimeSpan JwksCacheDuration { get; set; }
```

#### Property Value
[System\.TimeSpan](https://learn.microsoft.com/en-us/dotnet/api/system.timespan 'System\.TimeSpan')

## JwtBearerOptions\.MaxJwtAge Property {#Abblix.Oidc.Server.Common.Configuration.JwtBearerOptions.MaxJwtAge}

Maximum age of JWT assertions based on the 'iat' \(issued at\) claim\.
JWTs issued more than this duration in the past will be rejected\.
Set to null to disable this validation\.
Default is 10 minutes\.

```csharp
public System.Nullable<System.TimeSpan> MaxJwtAge { get; set; }
```

#### Property Value
[System\.Nullable&lt;](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[System\.TimeSpan](https://learn.microsoft.com/en-us/dotnet/api/system.timespan 'System\.TimeSpan')[&gt;](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')

### Remarks
Per RFC 7523 Section 3: "The authorization server MAY reject JWTs with an 'iat' claim value
that is unreasonably far in the past\."
This provides defense\-in\-depth against replay attacks, especially useful when RequireJti is disabled
or when the JTI cache has gaps\.

## JwtBearerOptions\.MaxJwtSize Property {#Abblix.Oidc.Server.Common.Configuration.JwtBearerOptions.MaxJwtSize}

Maximum allowed size for JWT assertions in characters\.
Prevents denial\-of\-service attacks via excessively large JWTs\.
Default is 8192 \(8KB\)\.

```csharp
public int MaxJwtSize { get; set; }
```

#### Property Value
[System\.Int32](https://learn.microsoft.com/en-us/dotnet/api/system.int32 'System\.Int32')

## JwtBearerOptions\.RequireJti Property {#Abblix.Oidc.Server.Common.Configuration.JwtBearerOptions.RequireJti}

Indicates whether the 'jti' \(JWT ID\) claim is required for replay protection\.
When enabled, JWTs without a jti claim will be rejected to prevent replay attacks\.
Default is true per RFC 7523 Section 5\.2 security recommendation\.

```csharp
public bool RequireJti { get; set; }
```

#### Property Value
[System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean')

## JwtBearerOptions\.StrictAudienceValidation Property {#Abblix.Oidc.Server.Common.Configuration.JwtBearerOptions.StrictAudienceValidation}

When true, the JWT audience claim must exactly match the token endpoint URL per RFC 7523 Section 3\.
When false, the application base URI is also accepted for compatibility with common implementations\.
Default is true for strict RFC 7523 compliance and security\.

```csharp
public bool StrictAudienceValidation { get; set; }
```

#### Property Value
[System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean')

### Remarks
Set to false only if you have legacy clients that use the application base URI as audience\.
Accepting the base URI widens the attack surface as JWTs intended for other endpoints
on the same server could potentially be misused\.

## JwtBearerOptions\.TrustedIssuers Property {#Abblix.Oidc.Server.Common.Configuration.JwtBearerOptions.TrustedIssuers}

Collection of trusted issuers configuration for JWT Bearer grant type\.
Each entry defines an external identity provider that is trusted to issue JWT assertions
that can be exchanged for access tokens at this authorization server\.

```csharp
public System.Collections.Generic.IEnumerable<Abblix.Oidc.Server.Common.Configuration.TrustedIssuer> TrustedIssuers { get; set; }
```

#### Property Value
[System\.Collections\.Generic\.IEnumerable&lt;](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[TrustedIssuer](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.TrustedIssuer 'Abblix\.Oidc\.Server\.Common\.Configuration\.TrustedIssuer')[&gt;](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')

### Remarks
Use cases include:
\- Service\-to\-service authentication with pre\-existing trust relationships
\- Token exchange between federated identity providers
\- Cross\-domain single sign\-on \(SSO\) scenarios
\- API\-to\-API communication with JWT from external identity provider