A resource does not need a continuous connection to the Weldall server. It only needs to retrieve the server metadata and signing keys; the SDK keeps the keys in a short-lived cache.
When a service cannot reach the Weldall issuer directly, the SDK can send those requests through a trusted HTTPS proxy.
const weldall = initWeldall("https://weldall.example.com", { // remaining resource options discoveryProxyOrigin: "https://weldall-discovery-proxy.example.com",});The Weldall URL in the first argument remains the identity the SDK expects. The proxy only forwards discovery requests; the SDK still checks that metadata and signatures come from that Weldall instance.
For most deployments, we recommend the included Nginx discovery proxy. Its Nginx configuration allows only these GET endpoints and forwards their JSON responses unchanged:
/.well-known/oauth-authorization-server- the JWKS path advertised in the metadata, currently
/api/oauth/jwks
Use a proxy only when the service cannot reach the issuer directly. It must be reachable over HTTPS and trusted.
The proxy is published as docker.io/seibertgroup/weldall-discovery-proxy and configured with a single variable, WELDALL_UPSTREAM. Docker images shows how to run it; How to: Google Cloud deploys it on Cloud Run.