diff --git a/security-and-access-control-1/how-to-guides/token-introspection.md b/security-and-access-control-1/how-to-guides/token-introspection.md index 7184026b..2a685e9c 100644 --- a/security-and-access-control-1/how-to-guides/token-introspection.md +++ b/security-and-access-control-1/how-to-guides/token-introspection.md @@ -26,6 +26,20 @@ jwt: secret: very-secret ``` +The other example would be: + +```html +PUT /TokenIntrospector/external-auth-server +content-type: text/yaml + +resourceType: TokenIntrospector +id: external-auth-server +type: "jwt" +jwt: + iss: +jwks_uri: /.well-known/jwks.json" +``` + {% hint style="warning" %} Currently we use common `secret` to validate our introspector works. In production installations it's better to switch to `jwks_uri` instead {% endhint %}