Right way to use JWT authentication

[sazanof]

Question

Hello! Mediamtx version 1.12.3
I'm trying to enable jwt authentication and I can't figure out why I can't access the token.
What should be the response from the server authJWTJWKS?
Config:

authJWTJWKS: http://localhost:3000/api/auth/mediamtx
authJWTClaimKey: mediamtx_permissions
authJWTExclude: []
authMethod: jwt
authJWTInHTTPQuery: true

Currently, I'm forming a signature like this:

#http://localhost:3000/api/auth/mediamtx
auth.get('/mediamtx', async (req: express.Request, res: express.Response) => {
  const ks = fs.readFileSync('Keys.json')
  const keyStore = await jose.JWK.asKeyStore(ks.toString())
  const [key] = keyStore.all({ use: 'sig' })

  const opt = { compact: true, jwk: key, fields: { typ: 'jwt' } }
  const payload = JSON.stringify({
    mediamtx_permissions: [
      { action: 'read', path: 'all' },
      { action: 'api', path: 'all' },
    ],
    exp: Math.floor((Date.now() + ms('1d')) / 1000),
    iat: Math.floor(Date.now() / 1000),
    sub: 'test',
  })
  const token = await jose.JWS.createSign(opt, key)
    .update(payload)
    .final()
  console.log(token)

  res.send({ token })
})

Then, make request with "Authorization: Bearer" (api, hls, webrtc - all return 401)

(body of 204 bytes)
2025/06/03 20:37:43 DEB [API] [conn [::1]:52394] [c->s] GET /v3/config/global/get HTTP/1.1
Host: localhost:9997
Accept: application/json, text/plain, */*
Accept-Encoding: gzip, deflate, br, zstd
Accept-Language: ru,en;q=0.9,bg;q=0.8,la;q=0.7,pl;q=0.6,fr;q=0.5,de;q=0.4,uk;q=0.3,tr;q=0.2,mt;q=0.1,es;q=0.1
Authorization: Bearer eyJ0eXAiOiJqd3QiLCJhbGciOiJSUzI1NiIsImtpZCI6IjlJUU04bmxJc05Na21paEkxY294ZGlTT09hRFBvQ2Q1SERnd3g4WHJQM3cifQ.eyJtZWRpYW10eF9wZXJtaXNzaW9ucyI6W3siYWN0aW9uIjoicmVhZCIsInBhdGgiOiJhbGwifSx7ImFjdGlvbiI6ImFwaSIsInBhdGgiOiJhbGwifV0sImV4c CI6MTc0OTA1ODQzMywiaWF0IjoxNzQ4OTcyMDMzLCJzdWIiOiJ0ZXN0In0.lkzEebIw2fAJzXbxZWpJd-IKUjqXjIDt_3Qd643W7w0PA9_BvIR4mAIRp2hXWYYBUSr0Lhe7aGnVB1UB_z4AUX-Kuaj4846bhaxVGX_gUib2z2TlyHbG2uaOqKhTgnq4qco0ec0hbYimfUbXI1wEvioDmNouwfWNX2L2yuwINOq59rWqMx5MldJkly9w2RXxDNz5o30TH101xJIWnBgI926xjlc_YWqJoK2OnCwcmRJV3PoJKwgD1yuaTM-hcDTxyJJAzrHBtsqWSvUVjmiwoomTIu_dezLrmdmsOfyftz6rwVJSXyge3qLNjbcH1P3qQP7Ywhin44377jo8tHltMw
Connection: keep-alive
Cookie: PHPSESSID=plnm935v4fn4qi6el3k3977a2p
Sec-Ch-Ua: "Chromium";v="134", "Not:A-Brand";v="24", "YaBrowser";v="25.4", "Yowser";v="2.5"
Sec-Ch-Ua-Mobile: ?0
Sec-Ch-Ua-Platform: "Windows"
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: none
Sec-Fetch-Storage-Access: active
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 YaBrowser/25.4.0.0 Safari/537.36


2025/06/03 20:37:45 DEB [API] [conn [::1]:52394] [s->c] HTTP/1.1 401 Unauthorized
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *
Server: mediamtx

You can check the signature - it contains the necessary data. What did I miss? Why is it not working?
Thanks!

[aler9]

Do not use path "all", use a regular expression:

{
  "action": "read",
  "path": "~.*"
}