---
schema_version: "1"
id: cb595dbef94308b6c51acf1034fc97bf8a3c4767e012241d9c994dabd03f2c3c
title: JWT Validation
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/release-notes/gateway/policies/jwt-validation-release-notes.md
canonical_url: https://docs.mulesoft.com/release-notes/gateway/policies/jwt-validation-release-notes
source_site: docs.mulesoft.com
content_type: documentation
content_hash: c79fa28470315728c8fe25407731805ca4770e7593ae6e25f590a5f5837b986d
description: MuleSoft Documentation Site
latest: true
---
---
product: Release Notes
version: master
keywords: release notes, omni gateway, policies, jwt validation
---

# JWT Validation

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

The JWT Validation policy validates a JWT.

For configuration details, see
[JWT Validation Policy](https://docs.mulesoft.com/gateway/latest/policies-included-jwt-validation).

## September 2, 2026

### What’s New

- You can now enable OAuth 2.0 Protected Resource Metadata
  ([RFC 9728](https://datatracker.ietf.org/doc/html/rfc9728)) in the JWT Validation policy. When
  enabled, the policy serves a protected resource metadata document at
  `{API_Path}/.well-known/oauth-protected-resource` and includes a `resource_metadata` hint in `401`
  responses, so that clients can discover the authorization server that protects the API. Enable
  this feature with the new `enableProtectedResourceMetadata` parameter and specify the
  authorization server to advertise with the new `protectedResourceMetadataAuthorizationServerUrl`
  parameter. For configuration details, see
  [JWT Validation Policy](https://docs.mulesoft.com/gateway/latest/policies-included-jwt-validation).

- JWT Validation policy implementation version 1.5.1 is now supported by Omni Gateway.

- JWT Validation policy definition version 0.12.0 is now supported by Omni Gateway.