iss
What this is
iss is a case-sensitive string, often an HTTPS origin (https://auth.example.com/). After signature verification, compare iss to the allow-list for that API. OIDC discovery documents advertise the issuer; JWKS is fetched from that host.
FAQ
- Trailing slash?
- https://example.com and https://example.com/ are different iss values. Copy the issuer from the discovery document exactly.