Allowed token algorithms for introspection responses and JWTs.
Allowed JWT signature algorithms for local verification.
Allowed JWT typ header values.
Allowed OAuth subjects or issuer-qualified subjects.
Allowed token type values from introspection responses.
Expected OAuth audience value.
Authorization endpoint advertised in OAuth metadata.
Whether localhost-only insecure issuer URLs are allowed for development.
Whether introspection may run without client or bearer authentication.
Trusted OAuth issuer URL.
Minimum JWKS cache TTL in seconds.
Maximum JWKS cache TTL in seconds.
Consecutive dependency failures before opening the JWKS circuit.
JWKS circuit open duration in milliseconds.
Maximum retry attempts for JWKS dependency calls.
Cooldown in milliseconds before refreshing JWKS for an unknown kid.
Retry delay in milliseconds for JWKS dependency calls.
JWKS request timeout in milliseconds.
JWKS endpoint URL.
Allowed clock skew in seconds for JWT numeric-date claims.
Public MCP deployment URL used when constructing metadata URLs.
Required OAuth scopes beyond the B2 deployment scope.
OAuth protected resource URL for this MCP deployment.
OptionalserviceOptional service documentation URL advertised in metadata.
Maximum cached token entries.
Token-cache expiration skew in seconds.
Token-cache TTL in seconds.
Token endpoint advertised in OAuth metadata.
Configuration required to verify JWT bearer tokens with a JWKS endpoint.