Found while building cadeom's config-JWT endpoint against UOA, verified in UOA source rather than inferred from behaviour.
AutoOnboardingFieldsSchema requires all three of domain, jwks_url and contact_email together. Publish jwks_url without contact_email and readOptInFields returns false, auto-onboarding silently never triggers, and the caller gets a generic CONFIG_JWT_INVALID with nothing pointing at the missing claim.
The guide presents the two as separate optional first-call fields, so the natural reading is that either alone opts in. The failure gives no hint otherwise — you are told your config JWT is invalid when it is structurally fine and merely incomplete for the path you wanted.
Ask: state that the trio is all-or-nothing, and ideally return a distinct code when jwks_url is present but contact_email is not.
Found while building cadeom's config-JWT endpoint against UOA, verified in UOA source rather than inferred from behaviour.
AutoOnboardingFieldsSchemarequires all three ofdomain,jwks_urlandcontact_emailtogether. Publishjwks_urlwithoutcontact_emailandreadOptInFieldsreturns false, auto-onboarding silently never triggers, and the caller gets a genericCONFIG_JWT_INVALIDwith nothing pointing at the missing claim.The guide presents the two as separate optional first-call fields, so the natural reading is that either alone opts in. The failure gives no hint otherwise — you are told your config JWT is invalid when it is structurally fine and merely incomplete for the path you wanted.
Ask: state that the trio is all-or-nothing, and ideally return a distinct code when
jwks_urlis present butcontact_emailis not.