This setting determines the format of the issuer (`iss`) claim in the Pomerium JWT. See [JWT Authentication](https://www.pomerium.com/docs/capabilities/getting-users-identity.md) for more information about the Pomerium JWT.

Before Pomerium v0.28, this claim was always set to the hostname portion of the route's [**From**](https://www.pomerium.com/docs/reference/routes/from.md) URL. Starting in v0.28, the issuer claim can be set to use a full URL instead. This may be necessary for interoperability with some JWT authentication consumers.

The default is hostname-only for backwards compatibility with existing Pomerium deployments.

## How to configure

**Core:**

| Config file key | Environment variable | Type | Default |
| :-- | :-- | :-- | :-- |
| `jwt_issuer_format` | `JWT_ISSUER_FORMAT` | string (one of `hostOnly` or `uri`) | `hostOnly` |

### Examples

```yaml
jwt_issuer_format: uri
```

**Enterprise:**

**Kubernetes:**

**JWT Issuer Format** is not currently supported in Ingress Controller.