---
title: "Add JWT Authentication to Your HAProxy API"
description: "Secure your HAProxy API using JWT authentication with JWKS."
canonicalUrl: "https://zuplo.com/use-cases/api-key-auth/c/haproxy/jwt-backend"
framework: "HAProxy"
language: "C"
authStrategy: "JWT with JWKS"
pageType: use-case
---

# Add JWT Authentication to Your HAProxy API

Secure your HAProxy API using JWT authentication with JWKS.

## How Zuplo Handles It

Let Zuplo issue short-lived JWTs signed with a JWKS your HAProxy backend can verify — no long-lived API keys touch your origin.

## HAProxy Backend Code

```c
# haproxy.cfg — validate JWTs issued by Zuplo against your JWKS public key.
#
# HAProxy 2.5+ verifies JWT signatures natively with the jwt_verify converter.
# Export the signing key from your Zuplo JWKS endpoint to PEM and reference it below.

frontend api
    bind *:80
    mode http

    # Pull the bearer token out of the Authorization header.
    http-request set-var(txn.bearer) http_auth_bearer
    http-request deny deny_status 401 unless { var(txn.bearer) -m found }

    # Require RS256 and verify the signature (jwt_verify returns 1 on success).
    http-request set-var(txn.alg) var(txn.bearer),jwt_header_query('$.alg')
    http-request deny deny_status 401 unless { var(txn.alg) -m str "RS256" }
    http-request deny deny_status 401 unless { var(txn.bearer),jwt_verify(txn.alg,"/etc/haproxy/zuplo-pubkey.pem") -m int 1 }

    # Optionally pin the issuer to your Zuplo gateway.
    http-request set-var(txn.iss) var(txn.bearer),jwt_payload_query('$.iss')
    http-request deny deny_status 403 unless { var(txn.iss) -m str "https://my-api.zuplo.dev/__zuplo/issuer" }

    default_backend my_backend

backend my_backend
    mode http
    server my_server localhost:8080
```

## Example Request

```bash
curl -X GET \
  'https://your-api.zuplo.dev/your-route' \
  -H 'Authorization: Bearer YOUR_API_KEY'
```

## Learn More

- [API Key Authentication on Zuplo](https://zuplo.com/docs/policies/api-key-auth-inbound)
- [JWT Authentication on Zuplo](https://zuplo.com/docs/policies/open-id-jwt-auth-inbound)
- [All use cases](https://zuplo.com/use-cases)