How do you secure a Micronaut application with JWT authentication?

Micronaut Security provides built-in JWT support: add the security-jwt module dependency, configure a signature secret or a JWKS endpoint for asymmetric keys, and Micronaut handles validating incoming bearer tokens automatically.

micronaut:
  security:
    authentication: bearer
    token:
      jwt:
        signatures:
          secret:
            generator:
              secret: "${JWT_SECRET}"

A login endpoint authenticates credentials against an AuthenticationProvider you implement, then returns a signed JWT, which Micronaut Security's built-in login controller can handle for you. Subsequent requests send that token in the Authorization: Bearer header, and a security filter validates the signature and expiry on every request before the controller method runs.

Controllers declare access rules with @Secured:

@Secured("ROLE_ADMIN")
@Get("/reports")
public List<Report> reports() { ... }

Roles and claims embedded in the token are checked against the @Secured value before the method executes, and rejected requests get a 401 or 403 automatically, with all of this validation logic itself implemented as generated Micronaut AOP-style security filtering, so it costs no reflective overhead at request time.