Configuration options for the MonoCloudBackendNodeClient.
Configuration values can be provided using either:
MONOCLOUD_BACKEND_* variables.When both are provided, constructor options override environment variables.
| Environment Variable | Description |
|---|---|
MONOCLOUD_BACKEND_TENANT_DOMAIN | The domain of your MonoCloud tenant (for example, https://your-tenant.us.monocloud.com). |
MONOCLOUD_BACKEND_AUDIENCE | The expected audience for access token validation (for example, https://api.example.com). |
| Environment Variable | Description |
|---|---|
MONOCLOUD_BACKEND_CLIENT_ID | Unique identifier for your application/client. |
MONOCLOUD_BACKEND_CLIENT_SECRET | Application/client secret used for authentication. When clientAuthMethod is private_key_jwt, provide the private key JWK as a JSON string (it is parsed automatically). |
MONOCLOUD_BACKEND_CLIENT_AUTH_METHOD | Client authentication method. |
| Environment Variable | Description |
|---|---|
MONOCLOUD_BACKEND_TRUST_STORE_ID | Identifier of the trust store whose mTLS endpoint aliases (mtls_additional_endpoint_aliases) should be used when authenticating with a mutual-TLS client authentication method. When omitted, the default mtls_endpoint_aliases are used. |
| Environment Variable | Description |
|---|---|
MONOCLOUD_BACKEND_CLOCK_SKEW | Allowed clock drift (in seconds) when validating token timestamps. |
MONOCLOUD_BACKEND_CLOCK_TOLERANCE | Additional time tolerance (in seconds) for time-based claim validation. |
MONOCLOUD_BACKEND_INTROSPECT_JWT_TOKENS | When true, JWT tokens are introspected at the server instead of being validated locally. |
| Environment Variable | Description |
|---|---|
MONOCLOUD_BACKEND_GROUPS_CLAIM | The claim name in the token that contains group memberships. |
MONOCLOUD_BACKEND_GROUPS_MATCH_ALL | When true, requires the token to contain all specified groups. |
| Environment Variable | Description |
|---|---|
MONOCLOUD_BACKEND_JWKS_CACHE_DURATION | Duration (in seconds) to cache the JSON Web Key Set (JWKS) used to verify tokens. |
MONOCLOUD_BACKEND_METADATA_CACHE_DURATION | Duration (in seconds) to cache the OpenID Connect discovery metadata. |
audience:string
The expected audience URI for access token validation (e.g. https://api.example.com).
optionalcache:IIntrospectionCache
Optional cache for access token introspection results. Only tokens validated via
introspection are cached (opaque tokens, and JWTs when introspectJwtTokens is true);
locally-validated JWTs are not cached.
optionalclientAuthMethod:ClientAuthMethod
Client authentication method used when the client authenticates to the authorization server.
"client_secret_basic";
optionalclientId:string
Client identifier of the application registered in MonoCloud.
Client secret or key material used for client authentication.
When clientAuthMethod is client_secret_jwt and a plain-text secret is provided, the default signing algorithm is HS256.
To use a different algorithm, provide a symmetric JSON Web Key (JWK) (kty: "oct") with the desired algorithm specified in its alg property.
When clientAuthMethod is spiffe_jwt, provide the SPIFFE JWT-SVID (obtained from the SPIFFE Workload API) as the plain-text string; it is sent as the client_assertion.
optionalclockSkew:number
Number of seconds to adjust the current time to account for clock differences.
0;
optionalclockTolerance:number
Additional time tolerance in seconds for time-based claim validation.
300;
optionalfetcher: {(input:URL|RequestInfo,init?:RequestInit):Promise<Response>; (input:string|URL|Request,init?:RequestInit):Promise<Response>; }
Optional custom fetch implementation used for network requests.
(input:URL|RequestInfo,init?:RequestInit):Promise<Response>
| Parameter | Type |
|---|---|
input | URL | RequestInfo |
init? | RequestInit |
Promise<Response>
(input:string|URL|Request,init?:RequestInit):Promise<Response>
| Parameter | Type |
|---|---|
input | string | URL | Request |
init? | RequestInit |
Promise<Response>
optionalgroupOptions:IsUserInGroupOptions
Options for group membership validation applied to all token validations performed by this client.
optionalintrospectJwtTokens:boolean
When true, JWT access tokens are introspected instead of locally validated.
This skips JWT signature/header/payload checks and always uses the introspection endpoint.
false;
optionaljwksCacheDuration:number
Duration (in seconds) to cache the JSON Web Key Set (JWKS) retrieved from the authorization server.
300;
Optional custom resolver for the JSON Web Key Set (JWKS).
optionalmetadataCacheDuration:number
Duration (in seconds) to cache OpenID Connect discovery metadata.
300;
Optional custom resolver for the issuer metadata (OpenID Connect discovery document).
IssuerMetadata | Promise<IssuerMetadata>
tenantDomain:string
The MonoCloud tenant domain URL (e.g. https://example.monocloud.dev).
optionaltrustStoreId:string
Identifier of the trust store whose mTLS endpoint aliases should be used when authenticating with a mutual-TLS client authentication method.