Skip to content

tokens

module wittgenstein_oidc_backend.tokens

Keycloak token decoding — two modes, mirroring AgentGateway's own policies.jwtAuth.mode toggle (see wittgenstein-deployment's roles/agentgateway/templates/config.yaml.j2):

  • "validate": full RS256 signature verification against the realm's JWKS, plus issuer/audience checks. Use this when the token reaches the service directly (no gateway already validated it).
  • "trust": decode the payload without verifying the signature. Use this only when an AgentGateway (or equivalent) upstream has already validated the token and the service trusts that boundary — this avoids a redundant JWKS round-trip on every request. Never default to this silently; callers must opt in explicitly.

Classes

  • TokenError — Raised for any token decode/verification failure — callers should treat this uniformly (401/403), never let the underlying jwt/httpx exception leak into a response.

Functions

  • decode_token — Decode a Keycloak-issued JWT and return its claims payload.

wittgenstein_oidc_backend.tokens.TokenError

class TokenError()

Bases : Exception

Raised for any token decode/verification failure — callers should treat this uniformly (401/403), never let the underlying jwt/httpx exception leak into a response.

wittgenstein_oidc_backend.tokens.decode_token

async decode_token(token: str, *, mode: OidcMode, jwks_client: JwksClient | None = None, issuer: str | None = None, audience: str | None = None) → dict[str, Any]

Decode a Keycloak-issued JWT and return its claims payload.

mode="validate" requires jwks_client and issuer. mode="trust" needs neither — it only decodes.

Raises