Search docs…⌘K
Dashboard →
Guides

Custom Authentication

Integrating third-party Identity Providers with Relay's Edge. Learn how to validate tokens from Auth0, Clerk, Firebase, and more before requests ever reach your backend.

Overview

If you already have an Identity Provider (IdP) such as Auth0, Clerk, or Firebase, you can easily integrate it with Relay. Clients simply pass their Bearer token in the Authorization header when making a request.

Relay's Edge validates the JWT signature against a configured JWKS (JSON Web Key Set) endpoint before the request reaches your backend. If the token is invalid or expired, Relay rejects the request automatically, protecting your upstream services from unauthenticated traffic.

How it works

  • Client: Obtains a JWT from your Identity Provider and includes it in the Authorization: Bearer <token> header.
  • Relay Edge: Intercepts the request and fetches the public keys from your configured JWKS endpoint.
  • Validation: The edge validates the signature, expiration, and optionally the audience/issuer.
  • Backend: Receives the validated request, ensuring that your backend only spends resources processing legitimate traffic.

Configuration

To enable custom authentication, you need to configure a JWKS URL in your API settings.

  1. Navigate to the Settings tab for your API in the Relay dashboard.
  2. Under Authentication, select Custom JWT (JWKS).
  3. Provide the JWKS endpoint URL from your Identity Provider (e.g., https://YOUR_DOMAIN.auth0.com/.well-known/jwks.json).
  4. Save your settings. Relay will immediately begin validating tokens on incoming requests.