no bug - add jwt_secret to README

diff --git a/README.rst b/README.rst
index 1b556d915f5c5d3a2ef8e2ed7c205eda47231c32..e19bc274e4823265f5a298bf4b8aec23dd2b01ff 100644 (file)
--- a/README.rst
+++ b/README.rst
@@ -342,6 +342,13 @@ BMO_site_wide_secret
   security features in Bugzilla, to protect against certain types of attacks.
   It's very important that this key is kept secret.
 
+BMO_jwt_secret
+  This secret key is used by your installation for the creation and validation
+  of jwts.  It's very important that this key is kept secret and it should be
+  different from the side_wide_secret. Changing this will invalidate all issued
+  jwts, so all oauth clients will need to start over. As such it should be a
+  high level of entropy, as it probably won't change for a very long time.
+
 BMO_inbound_proxies
   This is a list of IP addresses that we expect proxies to come from.
   This can be '*' if only the load balancer can connect to this container.