support multiple JWT secrets

for admin secret, we can set in the environment variable: HASURA_GRAPHQL_ADMIN_SECRET and pass x-hasura-admin-secret in header to authorize the permission.

in my scenario, i have two applications sharing the same Hasura API server. Theses two applications have their own JWT secret (specifically different jwk_url). I don’t want to duplicate the Hasura server to handle these two applications.

is it possible to set multiple JWT secrets into Hasura server? or pass the jwt secret to Hasura in header like x-hasura-jwt-secret? or specifically select the jwk_url in run-time?

[tirumaraiselvan]

Hey folks, this is available in Hasura Cloud (v2.3 onwards). The docs are available here: https://hasura.io/docs/latest/graphql/cloud/security/multiple-jwt-secrets/

If you are not on Cloud, there is a simple workaround:

1. Create a new endpoint that combines the result of all your JWK providers.
2. Use this endpoint as the jwk_url in a single JWT Secret configuration.

[smunozp]

Hello

There is any update in this? We have the same situation, we want to serve multitennant with the same server