Skip to main content
The jwt access mode gates a status page behind a Bearer token that Observer Cloud verifies against a public key (or a JWKS endpoint) you control. Use it when the audience already has an identity issued by your auth system, and you want the same identity to authorise status-page reads. If you want viewers to sign in with Google, Microsoft, or your company’s identity provider instead of issuing tokens yourself, use sign-in protected pages.

​
Prerequisites

  • A Pro plan or higher.
  • An RS256 signing key. Either a PEM public key or an HTTPS JWKS endpoint.
  • A way to issue tokens for the audience (typically your auth service or an Identity Provider).

​
Configure the page

1

Switch the page to JWT mode

Open the page in the console, then Access. Set:
  • Mode: JWT (Bearer token).
  • Public key (PEM), or Or JWKS URI: an https:// URL on a publicly resolvable host. Use whichever your issuer exposes.
  • Audience (optional): the aud claim Observer should require.
  • Issuer (iss, optional): the iss claim Observer should require.
Save.
2

Issue tokens

Sign tokens with the matching private key. Observer accepts the token on the status page, its /incidents view, the /embed widget, and the Atom/RSS feeds, two ways:
  • The Authorization: Bearer <token> header, for programmatic requests.
  • The ?token=<token> query parameter, for magic links you send a customer (a URL they open directly) and for embed iframes that cannot set headers.
A typical claim set:
claims
Tokens must include iat and be no older than one hour.
3

Validate the round trip

Open the page with the Bearer header set. Successful verification renders the page. A missing or invalid token returns 401.
Per-customer pagesWhen the audience is a set of distinct customers and each customer should see a different subset of metrics or different SLO thresholds, use customer-scoped pages instead. That mode adds per-customer routing on top of the same JWT verification.