Kong JWT Authentication Setup

I’m integrating Kong Gateway into our stack and need solid JWT-based authentication configured end-to-end. The work centres on Kong itself—not an external IdP—so you’ll be writing or customising Kong plugins, updating declarative configuration and making sure every upstream service is protected by signed tokens.

Deliverables
• Token expiration management: set sensible defaults, expose configuration for future tuning and confirm expired tokens are refused at the proxy layer.
• Token revocation: design a lightweight revocation strategy (e.g., blacklist in Redis or Postgres), wire it into a custom plugin or extend the existing jwt-claims-validation plugin, and document the revocation call-flow.
• Custom claims: enrich issued tokens with our own claims, have Kong validate them, and surface those claims to upstream services through headers.

Acceptance criteria
1. A docker-compose or k8s manifest that spins up Kong with the new JWT setup in one command.
2. Postman or curl scripts that demonstrate successful login, token usage, expiration failure and revoked-token rejection.
3. Clear README describing how to rotate signing keys and adjust claim validation rules.

I’ll provide access to the repo holding our current Kong declarative config and a sample service for integration testing. Keep the solution in vanilla Kong OSS; no paid Kong Enterprise features please.