> ## Documentation Index
> Fetch the complete documentation index at: https://docs.use.observer/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure JWT-scoped access

> Gate a status page behind a Bearer token verified against your public key or JWKS endpoint.

The `jwt` access mode gates a status page behind a Bearer token
that Observer Cloud verifies against a public key (or a JWKS
endpoint) you control. Use it when the audience already has an
identity issued by your auth system, and you want the same
identity to authorise status-page reads.

If you want viewers to sign in with Google, Microsoft, or your
company's identity provider instead of issuing tokens yourself, use
[sign-in protected pages](https://docs.use.observer/docs/guides/sign-in-protected-pages.md).

## Prerequisites

* A Pro plan or higher.
* An RS256 signing key. Either a PEM public key or an HTTPS JWKS
  endpoint.
* A way to issue tokens for the audience (typically your auth
  service or an Identity Provider).

## Configure the page

**1. Switch the page to JWT mode**

Open the page in the console, then **Access**. Set:

* **Mode**: **JWT (Bearer token)**.
* **Public key (PEM)**, or **Or JWKS URI**: an `https://` URL on a
  publicly resolvable host. Use whichever your issuer exposes.
* **Audience (optional)**: the `aud` claim Observer should require.
* **Issuer (iss, optional)**: the `iss` claim Observer should require.

Save.

**2. Issue tokens**

Sign tokens with the matching private key. Observer accepts the
token on the status page, its `/incidents` view, the `/embed` widget,
and the Atom/RSS feeds, two ways:

* The `Authorization: Bearer <token>` header, for programmatic
  requests.
* The `?token=<token>` query parameter, for magic links you send a
  customer (a URL they open directly) and for embed iframes that
  cannot set headers.

A typical claim set:

```json title="claims" theme={null}
{
  "iss": "https://your-idp.example",
  "aud": "observer-status-page",
  "sub": "user-or-customer-identifier",
  "iat": 1716476400,
  "exp": 1716480000
}
```

Tokens must include `iat` and be no older than one hour.

**3. Validate the round trip**

Open the page with the Bearer header set. Successful verification
renders the page. A missing or invalid token returns 401.

> [!NOTE]
>
> **Per-customer pages**
>
> When the audience is a set of distinct customers and each customer
> should see a different subset of metrics or different SLO
> thresholds, use [customer-scoped pages](https://docs.use.observer/docs/guides/customer-scoped-pages.md)
> instead. That mode adds per-customer routing on top of the same
> JWT verification.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.