--- name: azion-install-the-jwt-integration description: >- Install JWT from Azion Marketplace and run it on a firewall to validate JSON Web Tokens before requests reach your infrastructure. --- # Install the JWT integration You install the JWT integration from Azion Marketplace and run it on a [Firewall](/en/documentation/platform/firewall/), from Azion Console. Access tokens control access to online resources, such as APIs and media archives, and JSON Web Tokens (JWTs) simplify this control, although a JWT can be larger than a session ID and affect network speed. The integration validates each token on the firewall, before the request reaches your infrastructure, without a call to an authenticator server. You grant and revoke privileges with KIDs and secrets, and you set expiration dates. Five objects have to exist before a request is validated: the installed function, a firewall carrying the **Functions** module, a function instance holding the arguments, a Rules Engine rule with the **Run Function** behavior, and a workload deployment bound to the firewall. Each section below creates one of them. --- ## Prerequisites - An Azion account. To sign in, refer to [How to access Azion Console](/en/documentation/guides/platform/account-and-billing/how-to-access-azion-console/). - An application served by a [workload](/en/documentation/platform/workloads/), whose deployment you bind to the firewall in the last section. - The [Azion CLI](/en/documentation/devtools/cli/) installed and authorized, for the last section. - Turning on a product or a module can generate usage costs. For more information, refer to [Pricing](/en/documentation/fundamentals/pricing/). --- ## Install the integration The function is installed once per account. To install it: 1. **Open Marketplace** Access [Azion Console](https://console.azion.com/) > **Marketplace**. 2. **Find the integration** Enter `JWT` in the **Search on Marketplace** field, then select the integration's card. Browsing the cards and the categories reaches the same page. 3. **Select Install** The card shows `Successfully installed!` and `Latest version installed!`, and the function appears in the **Function** list of the **Create Instance** drawer. --- ## Create the firewall The firewall is where the function is instanced and where the rule that runs it lives. To create one: 1. **Open the Firewalls page** Access [Azion Console](https://console.azion.com/) > **Firewalls**, then create a firewall. 2. **Name the firewall** In the **General** section, enter a **Name**. For example: `jwt-firewall`. 3. **Turn on the Functions module** In the **Modules** section, turn on the **Functions** switch. 4. **Save the firewall** The firewall shows a **Functions Instances** tab while the **Functions** module stays on. To use an existing firewall instead, turn on its **Functions** module and save it. For every setting on this form, refer to [Set a firewall's main settings](/en/documentation/guides/application-security/firewall-and-waf/firewall-configure-main-settings/). --- ## Create the function instance The instance holds the KIDs and secrets that the function accepts. To create it: 1. **Open the Functions Instances tab** In **Firewalls**, select your firewall, then select the **Functions Instances** tab. 2. **Select + Function** A firewall that has no instance shows the same action as **Function Instance**. The **Create Instance** drawer opens. 3. **Name the instance** In **Name**, enter a name. For example: `jwt`. 4. **Select the installed function** In **Function**, select the JWT function. The list holds only the functions that run on a firewall. 5. **Enter the arguments** In **Arguments**, the editor is prefilled with the integration's default arguments in JSON. Enter your KIDs, as the next section describes. 6. **Select Save** The instance is listed in the **Functions Instances** tab. ### Arguments The editor loads an example of KIDs, like the one below: ```json [{ “kids”: { “4546D4AA7F62F01A833A7ABE354030E7": “D6CB2342E44EFB6DD628276F36DA2359”, “D6CB2342E44EFB6DD628276F36DA2359": “60BD8ED7A768E8BD6925BEB0A691AADB”, “60BD8ED7A768E8BD6925BEB0A691AADB”: “4546D4AA7F62F01A833A7ABE354030E7” } }] ``` --- ## Create the rule The instance validates nothing until a rule runs it. A [Rules Engine for Firewall](/en/documentation/platform/firewall/rules-engine/) rule selects the requests that reach the instance, through a **Run Function** behavior. To create the rule: 1. **Open the Rules Engine tab** In **Firewalls**, select your firewall, then select the **Rules Engine** tab. 2. **Select + Rule** 3. **Name the rule** In **Name**, enter a name. For example: `Run JWT`. 4. **Set the criterion** In the **Criteria** section, select the domains that run the integration. For example: if `Host` *matches* `yourdomain.com`. 5. **Add the Run Function behavior** In the **Behaviors** section, select **Run Function**, then select the instance by the name you gave it. 6. **Select Save** The firewall runs the instance on every request to the domain in the criterion. --- ## Bind the firewall to the workload The binding is on the workload's deployment, so create a deployment that names both the application and the firewall: ```bash azion create workload-deployment --workload-id --name \ --application-id --firewall-id --strategy-type default \ --active true --current true ``` The command prints the id of the new deployment: ```text Created Workload Deployment with ID 123456 ``` Requests to the workload's domain reach the firewall, and the rule runs the JWT instance on each one. --- ## Next steps - [Set up a paywall with the JWT function](/en/documentation/guides/application-development/functions-and-runtime/paywall-function-jwt.md): A use case that puts the JWT function behind a paywall. - [Marketplace integrations](/en/documentation/platform/marketplace/integrations.md): Every integration Azion Marketplace offers, and where each one runs. - [Rules Engine for Firewall](/en/documentation/platform/firewall/rules-engine.md): Every criterion and behavior a firewall rule accepts. - [Update an integration](/en/documentation/guides/application-development/integrations/update-an-integration.md): Move an installed integration to its latest version.