> ## Documentation Index
> Fetch the complete documentation index at: https://docs.gatelit.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# OIDC Bearer Tokens

> If your users already have a session token from Clerk, Supabase Auth, or Auth0, pass it directly to the gateway.

The `Bearer` scheme lets you reuse your existing authentication layer. If a user already holds a valid OIDC JWT from your identity provider, they can pass it to Gatelit without any additional token-signing step.

The gateway decodes the token, fetches your provider's public keys from its JWKS endpoint, and verifies the signature. No token storage or introspection endpoint calls are made — only the signature and standard claims (`exp`, `iss`, `sub`) are checked.

## Supported providers

| Provider          | Notes                                             |
| ----------------- | ------------------------------------------------- |
| **Clerk**         | Pass the session JWT from `getToken()`            |
| **Supabase Auth** | Pass the access token from `session.access_token` |
| **Auth0**         | Pass the ID or access token                       |

Any OIDC provider that exposes a `/.well-known/jwks.json` endpoint under the token's `iss` claim will work.

## Usage with GatelitClient

Pass your identity provider's token in `getToken` with `scheme: "Bearer"`.

<CodeGroup>
  ```ts Clerk theme={null}
  import { GatelitClient } from "@gatelit/sdk"
  import { useAuth } from "@clerk/nextjs"

  const { getToken } = useAuth()

  const client = new GatelitClient({
    gatewayUrl: "https://gateway.yourapp.com",
    getToken: async () => {
      const token = await getToken()
      return { token: token!, scheme: "Bearer" }
    },
  })
  ```

  ```ts Supabase Auth theme={null}
  import { GatelitClient } from "@gatelit/sdk"
  import { createClient } from "@supabase/supabase-js"

  const supabase = createClient(SUPABASE_URL, SUPABASE_ANON_KEY)

  const client = new GatelitClient({
    gatewayUrl: "https://gateway.yourapp.com",
    getToken: async () => {
      const { data } = await supabase.auth.getSession()
      return { token: data.session!.access_token, scheme: "Bearer" }
    },
  })
  ```

  ```ts Auth0 theme={null}
  import { GatelitClient } from "@gatelit/sdk"
  import { useAuth0 } from "@auth0/auth0-react"

  const { getAccessTokenSilently } = useAuth0()

  const client = new GatelitClient({
    gatewayUrl: "https://gateway.yourapp.com",
    getToken: async () => {
      const token = await getAccessTokenSilently()
      return { token, scheme: "Bearer" }
    },
  })
  ```
</CodeGroup>

Once the client is configured, use it normally:

```ts theme={null}
const response = await client.chat({
  model: "openai/gpt-4o",
  messages: [{ role: "user", content: "Summarize this for me." }],
})

console.log(response.content)
```

## Using the token directly (without the SDK)

If you're not using `GatelitClient`, set the `Authorization` header manually:

```ts theme={null}
const token = await getToken() // your provider's method

const response = await fetch("https://gateway.yourapp.com/v1/chat/completions", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    Authorization: `Bearer ${token}`,
  },
  body: JSON.stringify({
    model: "openai/gpt-4o",
    messages: [{ role: "user", content: "Hello!" }],
  }),
})
```

## How verification works

When the gateway receives a `Bearer` token it:

1. Decodes the JWT header to read the `kid` (key ID) claim.
2. Reads the `iss` (issuer) claim from the payload.
3. Fetches the provider's JWKS from `<issuer>/.well-known/jwks.json` (cached for one hour).
4. Finds the matching public key by `kid`.
5. Verifies the HMAC or RSA signature.
6. Checks that the token has not expired (`exp` claim).

<Note>
  The gateway extracts the user's `sub` claim for request attribution in logs. No other user data is read from the token.
</Note>