Interface: VerifyOcTokenOptions
Defined in: me-client/src/server.ts:79 (opens in a new tab)
ExtendsLink to this section
Extended byLink to this section
PropertiesLink to this section
| Property | Type | Description | Defined in |
|---|---|---|---|
audience? | AudienceRule | Accepted aud · see AudienceRule. An integrator verifying tokens from the sign-in popup sets this to its own origin, e.g. "https://example.com", so a token issued to another site is refused.Inherited from VerifyOcOptions.audience | auth-core/src/index.ts:828 (opens in a new tab) |
issuer? | string | Auth host issuer. Defaults to https://ochk.io (opens in a new tab).Inherited from VerifyOcOptions.issuer | auth-core/src/index.ts:818 (opens in a new tab) |
jwksCacheTtlMs? | number | JWKS cache TTL in ms. Defaults to 1 hour. Stale-on-error: if the cache exists, verification still works during a transient outage.Inherited from VerifyOcOptions.jwksCacheTtlMs | auth-core/src/index.ts:821 (opens in a new tab) |
jwksMaxStaleMs? | number | How old a cached JWKS may be and still stand in during an outage. Defaults to 6 hours; past it, verification fails closed.Inherited from VerifyOcOptions.jwksMaxStaleMs | auth-core/src/index.ts:824 (opens in a new tab) |
requireHandle? | boolean | Refuse a token bound to your site (one with aud) that carries no rh, its handle on your project's list of ended sessions. Without it "sign out everywhere" can't reach the session, so it is refused by default. Every token ochk.app's sign-in popup issues carries one; false accepts one minted some other way, and then sign out everywhere does not end it. A family session (no aud, on *.ochk.io) is not held to this: the family's own feed ends it. audience: '*' admits family sessions too, so keep it for routes that receive tokens forwarded from *.ochk.io. Default: true.Inherited from - | me-client/src/server.ts:91 (opens in a new tab) |