OptionalalgorithmsPermitted JWS algorithms. Defaults to whatever the JWKS advertises.
OptionalaudienceProvider-specific JWT audience, when it differs from the MCP resource.
Expected iss claim. Tokens from any other issuer are rejected.
A list accepts any of the listed issuers.
OptionalissuerTreat successful issuer validation as the provider's resource binding. Use only for providers whose access-token model is scoped by issuer rather than an aud/resource claim.
JWKS endpoint the signing keys are fetched from and cached.
OptionalkeySymmetric key material, for providers that sign without a JWKS.
Canonical URL of this MCP resource, matched against the token binding.
Configures issuer, keys, and claims enforced by a JWT verifier.