Configuration
The settings that apply to every issuer, and why the token has its own header.
These settings sit directly under ApiOidc, beside Issuers, and apply to every issuer.
| Setting | Default | What it does |
|---|---|---|
HeaderName |
X-Oidc-Token |
The header that carries the token. A Bearer prefix is accepted. |
ClockSkew |
00:01:00 |
How far token lifetimes may disagree with the server clock. |
The site refuses to start if an issuer is missing what it needs, so a typo cannot quietly let everyone in.
Why not the Authorization header?
Many platforms’ examples send the token as Authorization: Bearer. The Delivery API already uses that header for member authorization, so this package defaults to its own header. If your site does not use member authorization, you can set HeaderName to Authorization.