Function Compute:Configure JWT authentication for a custom domain name

Step 1: Open the custom domain name settings

1. Log on to the Function Compute console. In the left-side navigation pane, choose Advanced Features > Custom Domains.

2. In the top navigation bar, select the region where your custom domain name resides.

3. On the Custom Domains page, click the domain name you want to configure.

4. In the upper-right corner, click Modify.

Step 2: Enable JWT authentication

On the Modify Custom Domain Name page, set Authentication Method to JWT Authentication.

Step 3: Configure the JWKS

JWT authentication requires a valid JWKS containing your public key. You can generate one using an online tool such as mkjwk.org. If you have a private key in PEM format, use a tool like jwx to convert it to JWKS format.

To generate a JWKS on mkjwk.org: set Key Use, Algorithm, and Show X.509, then click Generate. The tool produces two keys:

• ① Private key — use this in your code to sign (issue) JWT tokens. Keep it confidential.

• ② Public key — paste this into the keys array in the Function Compute console.

The JWKS you paste into the console follows this structure:

{
    "keys": [
        {
            "alg": "RS256",
            "e": "AQAB",
            "kty": "RSA",
            "n": "u1LWgoomekdOMfB1lEe96OHehd4XRNCbZRm96RqwOYTTc28Sc_U5wKV2umDzolfoI682ct2BNnRRahYgZPhbOCzHYM6i8sRXjz9Ghx3QHw9zrYACtArwQxrTFiejbfzDPGdPrMQg7T8wjtLtkSyDmCzeXpbIdwmxuLyt_ahLfHelr94kEksMDa42V4Fi5bMW4cCLjlEKzBEHGmFdT8UbLPCvpgsM84JK63e5ifdeI9NdadbC8ZMiR--dFCujT7AgRRyMzxgdn2l-nZJ2ZaYzbLUtAW5_U2kfRVkDNa8d1g__2V5zjU6nfLJ1S2MoXMgRgDPeHpEehZVu2kNaSFvDUQ",
            "use": "sig"
        }
    ]
}

Step 4: Configure the JWT token location

In the JWT Token Configuration section, set Read Position (Header, Cookie, Query Parameters, or Form Parameters) and the parameter name where Function Compute should look for the token.

If you set Read Position to Header, specify a Remove Prefix value. Function Compute strips this prefix before parsing the token. For example, if you set the prefix to Bearer, a request header Authorization: Bearer <token> causes Function Compute to extract and validate <token>.

Step 5: Configure claim forwarding (optional)

In the JWT Claim Conversion section, map JWT claims to function parameters. For each mapping, specify:

• Mapping Parameter Position — where to forward the claim (Header, Cookie, Query Parameters, or Form Parameters)

• The original claim name in the token

• The parameter name passed to the function

Step 6: Save the configuration

Click Save.

Generate a test token

1. Install the PyJWT module. See PyJWT.

2. Run the following Python script locally to generate a token. Replace the private key placeholder with the X.509 PEM private key from the JWKS generation step.

import jwt
import time

private_key = """
-----BEGIN PRIVATE KEY-----
<Your X.509 PEM private key>
-----END PRIVATE KEY-----
"""

headers = {
    "alg": "RS256",
    "typ": "JWT"
}

payload = {
    "sub": "1234567890",
    "name": "John Snow",
    "iat": int(time.time()),              # Token issuance time
    "exp": int(time.time()) + 60 * 60,   # Token expires in 1 hour
}

encoded = jwt.encode(payload=payload, key=private_key.encode(), headers=headers)
print("Generated token: %s" % encoded)

Test with Postman

1. In the Function Compute console, go to Advanced Features > Custom Domains. Copy your custom domain name and paste it into the URL field in Postman.

2. Add a request header that matches your JWT Token Configuration settings. For example, if the parameter name is Authentication and the prefix is Bearer:

   Important

   Ensure that the formatting of the JWT in the request header aligns with the configured Remove Prefix settings. If there is a mismatch, an invalid or expired jwt error is returned.

   Parameter	Value	Description
   Key	Authentication	The parameter name configured in JWT Token Configuration
   Value	Bearer <your-jwt-token>	The configured prefix, a space, and the token generated in the previous step

3. Click Send and check the response.

If claim forwarding is configured, the response confirms the claim was passed to the function. For example, nametofunction is the forwarded parameter name from the claim mapping.