MoqTrustedKey

A key trusted to sign MoQ auth tokens (EdDSA JWT). A token is valid only if its kid names a trusted key whose prefix contains the token’s root.

Field

Type

Repeated

Description

kid

string

public_key

string

The raw 32-byte Ed25519 public key, base64url without padding (a JWK’s x). Standard base64 is accepted too.

prefix

string

✅

Namespace prefix, as segments. Empty = any namespace on this listener.

Member of

Message

Description

MoqListenerAuth

MoQ auth on a listener. Off (the default) is exactly the behaviour without it: no token needed, none checked. Required: a session must present a valid token (WebTransport CONNECT ?jwt=, the PATH option’s ?jwt= on QUIC, or the SETUP AUTHORIZATION TOKEN option) signed by a trusted key, and every publish / subscribe / fetch / namespace subscription is checked against its put / get grants.