JWE Decrypt Configuration
Configuration reference for the JWE Decrypt plugin (`jwe-decrypt`): the parameters on consumers and routes or services, each attribute with its type, whether it is required, its default and its accepted values.
Parameters
See plugin common configurations (opens in Apache APISIX docs) for configuration options available to all plugins.
Consumers
The following are plugin attributes available for configurations on consumers (opens in Apache APISIX docs).
key — string · required · since APISIX 3.8.0 · API7 Gateway 3.10.7
A unique key that identifies the credential for a consumer.
secret — string · required · since APISIX 3.8.0 · API7 Gateway 3.10.7
Valid values: 32 bytes
A shared symmetric key of 32 bytes, given as a literal value — either plaintext, or base64url encoded with is_base64_encoded set. The Control Plane checks the length of the value as written, so a $env:// or $secret:// reference is rejected unless the reference string itself happens to be 32 characters.
is_base64_encoded — boolean · optional · default: false · since APISIX 3.8.0 · API7 Gateway 3.10.7
Set to true if the secret is base64url encoded. The decoded secret must still be 32 bytes.
Routes or Services
The following are plugin attributes available for configurations on routes (opens in Apache APISIX docs) or services (opens in Apache APISIX docs).
header — string · required · default: Authorization · since APISIX 3.8.0 · API7 Gateway 3.10.7
The header to get the token from.
forward_header — string · required · default: Authorization · since APISIX 3.8.0 · API7 Gateway 3.10.7
Name of the header that passes the plaintext to the upstream.
strict — boolean · optional · default: true · since APISIX 3.8.0 · API7 Gateway 3.10.7
If true, return a 403 error when the encrypted plugin token is missing. If false, continue when the token is not found.