lexik_jwt_authentication:
    secret_key: '%env(resolve:JWT_SECRET_KEY)%'
    public_key: '%env(resolve:JWT_PUBLIC_KEY)%'
    pass_phrase: '%env(JWT_PASSPHRASE)%'
    token_ttl: 21600 # 6 hours in seconds
    clock_skew: 0

    # Token extractors configuration
    token_extractors:
        # Extract from Authorization header (default, always enabled)
        authorization_header:
            enabled: true
            prefix: Bearer
            name: Authorization

        # Extract from query parameter (for <img> tags and media URLs)
        query_parameter:
            enabled: true
            name: token  # ?token=YOUR_JWT_TOKEN
