Skip to main content
Three settings. MUDRAID_EXPECTED_ISSUERS is comma-separated: leave it unset to accept the single default issuer, set one value to pin a specific issuer, or list several to accept any of them during an issuer migration. A token whose iss isn’t in the accepted set is rejected with WRONG_ISSUER.
The v0.1 alpha still ships an older placeholder as its built-in default. Set MUDRAID_JWKS_URL=https://api.mudraid.ai/.well-known/jwks.json explicitly until the package default is updated.
Everything else (cache TTLs, clock-skew leeway, body limits) is internal and stable in v1.

​
The YAML path

By default the middleware looks for mudraid_scopes.yaml in the working directory. Set scopes_yaml_path if it lives elsewhere. The file is loaded once, on the first request. To change it, redeploy. See Manage the scopes lifecycle.