Millipede Academy

Book 3 · Lesson 3.2

JWT edge authentication

  • Trace Bearer JWT validation in gateway middleware
  • Explain scope claims for manager access
  • Mint and use a dev token

Prerequisites: 3.1

The gateway is the JWT enforcement point — backends trust mTLS from gateway, not browser tokens.

Claims shape

struct Claims {
    sub: String,           // "manager-dev"
    scope: String,         // "team_radar:manager"
    exp: usize,
}

Step through JwtValidationFlow — try guest scope → 403.

Dev mint

cargo run -p millipede-gateway --bin mint_dev_jwt
curl -sk https://localhost:8443/api/metrics/summary \
  -H "Authorization: Bearer <token>"

See services/gateway/src/main.rs — require_manager_jwt.

Teach-back prompt

Why does the gateway strip Authorization before proxying upstream?

Mint dev JWT

Lesson 3.2 check

1. millipede manager JWT scope is…