OAuthAuthorizer

Protect API Gateway routes with Auth0, Clerk, Okta, Google or any OIDC provider. Give it an issuer and audience; Anvil does the rest.

API & Auth · anvil:aws:OAuthAuthorizer

Arguments

Names below are TypeScript (camelCase). In Python use snake_case (e.g. dataClassification → data_classification); in Go use PascalCase on the Args struct (e.g. DataClassification).

issuer required

string

The OIDC issuer URL of your identity provider. API Gateway fetches public signing keys from {issuer}/.well-known/jwks.json. Examples: Auth0: 'https://your-tenant.auth0.com/', Clerk: 'https://your-instance.clerk.accounts.dev', Google: 'https://accounts.google.com'.

audience required

string[]

The intended recipients of the JWT. API Gateway rejects tokens whose 'aud' claim does not match one of these values. For Auth0 this is the API identifier (e.g. 'https://api.myapp.com'), not the application's client ID — and the application must be authorized for user access to that API.

Attributes

Outputs available once the resource is deployed.

authorizerId

string

A reference to this authorizer's issuer and audience — not an API Gateway ID. Pass it to HttpApi.defaultAuthorizerId; the HttpApi creates the authorizer on its own API.