diff --git a/install.rst b/install.rst
index c5c81e17a..f8cae8bb8 100644
--- a/install.rst
+++ b/install.rst
@@ -84,6 +84,7 @@ secret-is-base64  Bool    False
 max-rows          Int     ∞
 pre-request       String
 app.settings.*    String
+role-claim-key    String  .role
 ================  ======  =======  ========
 
 db-uri
@@ -136,6 +137,18 @@ pre-request
   A schema-qualified stored procedure name to call right after switching roles for a client request. This provides an opportunity to modify SQL variables or raise an exception to prevent the request from completing.
 app.settings.*
   Arbitrary settings that will become database session settings. This can be used to pass in secret keys directly as strings, or via OS environment variables. For instance: :code:`app.settings.jwt_secret = "$(MYAPP_JWT_SECRET)"` will take :code:`MYAPP_JWT_SECRET` from the environment and make it available to postgresql functions as :code:`current_setting('app.settings.jwt_secret')`.
+role-claim-key
+  A JSPath DSL that specifies the location of the :code:`role` key in the JWT claims. This can be used to consume a JWT provided by a third party service like Auth0, Okta or Keycloak. Some examples:
+
+.. code:: bash
+
+  # {"postgrest":{"roles": ["other", "author"]}}
+  # the DSL accepts characters that are alphanumerical or one of "_$@" as keys
+  role-claim-key = ".postgrest.roles[1]"
+
+  # {"https://www.example.com/role": { "key": "author }}
+  # non-alphanumerical characters can go inside quotes(escaped in config value)
+  role-claim-key = ".\"https://www.example.com/role\".key"
 
 Running the Server
 ------------------