Auth Layer Setup

AuthLayer validates bearer JWTs and inserts auth context into request extensions for downstream handlers.

Minimal protected app

use axum::{routing::get, Router};
use wacht::middleware::AuthLayer;

async fn protected() -> &'static str {
    "ok"
}

pub fn app() -> Router {
    Router::new()
        .route("/protected", get(protected))
        .layer(AuthLayer::new())
}

Startup behavior options

AuthLayer supports multiple initialization patterns:

• AuthLayer::new() Reads signing material from SDK global config and panics if missing.
• AuthLayer::try_new() Returns Option<AuthLayer> instead of panicking.
• AuthLayer::with_public_key("...") Uses explicit public key material for this layer instance.

Explicit validation tuning

use wacht::middleware::AuthLayer;

let layer = AuthLayer::with_public_key("-----BEGIN PUBLIC KEY-----...")
    .allowed_clock_skew(10)
    .required_issuer("https://your-deployment.fapi.trywacht.xyz")
    .validate_exp(true)
    .validate_nbf(true);

Recommended placement

• Apply AuthLayer at the narrowest route scope that needs auth.
• Keep public routes outside this layer.
• Combine with permission extractors in handlers for fine-grained authorization.