OIDC Bearer Tokens

The Bearer scheme lets you reuse your existing authentication layer. If a user already holds a valid OIDC JWT from your identity provider, they can pass it to Gatelit without any additional token-signing step. The gateway decodes the token, fetches your provider’s public keys from its JWKS endpoint, and verifies the signature. No token storage or introspection endpoint calls are made — only the signature and standard claims (exp, iss, sub) are checked.

Supported providers

Provider	Notes
Clerk	Pass the session JWT from `getToken()`
Supabase Auth	Pass the access token from `session.access_token`
Auth0	Pass the ID or access token

Any OIDC provider that exposes a /.well-known/jwks.json endpoint under the token’s iss claim will work.

Usage with GatelitClient

Pass your identity provider’s token in getToken with scheme: "Bearer".

import { GatelitClient } from "@gatelit/sdk"
import { useAuth } from "@clerk/nextjs"

const { getToken } = useAuth()

const client = new GatelitClient({
  gatewayUrl: "https://gateway.yourapp.com",
  getToken: async () => {
    const token = await getToken()
    return { token: token!, scheme: "Bearer" }
  },
})

import { GatelitClient } from "@gatelit/sdk"
import { createClient } from "@supabase/supabase-js"

const supabase = createClient(SUPABASE_URL, SUPABASE_ANON_KEY)

const client = new GatelitClient({
  gatewayUrl: "https://gateway.yourapp.com",
  getToken: async () => {
    const { data } = await supabase.auth.getSession()
    return { token: data.session!.access_token, scheme: "Bearer" }
  },
})

import { GatelitClient } from "@gatelit/sdk"
import { useAuth0 } from "@auth0/auth0-react"

const { getAccessTokenSilently } = useAuth0()

const client = new GatelitClient({
  gatewayUrl: "https://gateway.yourapp.com",
  getToken: async () => {
    const token = await getAccessTokenSilently()
    return { token, scheme: "Bearer" }
  },
})

Once the client is configured, use it normally:

const response = await client.chat({
  model: "openai/gpt-4o",
  messages: [{ role: "user", content: "Summarize this for me." }],
})

console.log(response.content)

Using the token directly (without the SDK)

If you’re not using GatelitClient, set the Authorization header manually:

const token = await getToken() // your provider's method

const response = await fetch("https://gateway.yourapp.com/v1/chat/completions", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    Authorization: `Bearer ${token}`,
  },
  body: JSON.stringify({
    model: "openai/gpt-4o",
    messages: [{ role: "user", content: "Hello!" }],
  }),
})

How verification works

When the gateway receives a Bearer token it:

Decodes the JWT header to read the kid (key ID) claim.
Reads the iss (issuer) claim from the payload.
Fetches the provider’s JWKS from <issuer>/.well-known/jwks.json (cached for one hour).
Finds the matching public key by kid.
Verifies the HMAC or RSA signature.
Checks that the token has not expired (exp claim).

The gateway extracts the user’s sub claim for request attribution in logs. No other user data is read from the token.

Get Started

Authentication

Guides

Dashboard

OIDC Bearer Tokens

Supported providers

Usage with GatelitClient

Using the token directly (without the SDK)

How verification works

​Supported providers

​Usage with GatelitClient

​Using the token directly (without the SDK)

​How verification works

Supported providers

Usage with GatelitClient

Using the token directly (without the SDK)

How verification works