TYO MQ Manager

Require auth Ephemeral Add

Rename

Tokens no local credential recognizes (realm JWTs, configured tokens) are validated by POSTing them to a validator URL with the X-MQ-Auth-Secret header. Local credentials are always checked first, so enabling this cannot break existing clients. Validators can be scoped to one realm or a realm prefix — a scoped validator can only authorize tokens into its own realm(s); the most specific scope wins.

Scope — blank for global, a realm name, or a realm prefix ending in ":"

Validation URL (auth_url)

Callback secret (auth_secret)

Save Disable

Bearer tokens for the HTTP management API (POST /api/realms). Each token can only create or rotate realms under its prefix. Tokens are generated in the browser and shown once — copy immediately; the server keeps only a hash.

Generate