# AuthenticateJwtOptions

Options for `ListenerAction.authenticateJwt()`.

- Source: [`aws-elasticloadbalancingv2/lib/alb/application-listener-action.ts`](https://github.com/aws/aws-cdk/blob/v2.275.0/packages/aws-cdk-lib/aws-elasticloadbalancingv2/lib/alb/application-listener-action.ts#L458)
- Type last changed: v2.247.0 · 2 Apr 2026

## Example

```ts
declare const lb: elbv2.ApplicationLoadBalancer;
declare const certificate: elbv2.IListenerCertificate;
declare const myTargetGroup: elbv2.ApplicationTargetGroup;

// JWT authentication requires HTTPS
const listener = lb.addListener('Listener', {
  protocol: elbv2.ApplicationProtocol.HTTPS,
  port: 443,
  certificates: [certificate],
  defaultAction: elbv2.ListenerAction.authenticateJwt({
    issuer: 'https://issuer.example.com',
    jwksEndpoint: 'https://issuer.example.com/.well-known/jwks.json',
    next: elbv2.ListenerAction.forward([myTargetGroup]),
  }),
});
```

## Properties

- `issuer`: string (required) — The issuer of the JWT token.

  This must be a full URL, including the HTTPS protocol, the domain, and the path.

  ```ts
  'https://issuer.example.com'
  ```

- `jwksEndpoint`: string (required) — The JWKS (JSON Web Key Set) endpoint URL.

  The endpoint must be publicly accessible and return the public keys used to verify JWT signatures.

  ```ts
  'https://issuer.example.com/jwks'
  ```

- `next`: [ListenerAction](/cdk/api/v2/docs/aws-cdk-lib.aws_elasticloadbalancingv2.ListenerAction.html) (required) — What action to execute next.

  Multiple actions form a linked chain; the chain must always terminate in a
  (weighted)forward, fixedResponse or redirect action.