One shared secret decides whether Nextcloud and OnlyOffice trust each other. Set it once, set it identically, and half of all integration errors never happen.
The JWT secret is the shared password between your two servers. This page shows where it lives on the OnlyOffice side, where it goes in the Nextcloud connector, and how to recover when the two copies disagree - the single most common cause of token errors and view-only documents.
When Nextcloud asks OnlyOffice to open a document, it signs the request with a token (JWT) using the shared secret. The Docs server checks the signature with its copy of the secret. If they match, it trusts the request; if not, you get errors like the document security token is not correctly formed, or documents that refuse to edit. The same secret also protects the callback that carries your edited file back to Nextcloud.
In plain words: the secret is the password the two servers share with each other. Nobody types it to log in - but if it differs by even one character, the partnership is broken.
-e JWT_ENABLED=true -e JWT_SECRET=YourLongSecretValue. Recreate the container if you change it - a restart alone does not pick up new environment values./etc/onlyoffice/documentserver/local.json in the token settings. Edit it, then restart the Docs services so the new value is loaded.The connector also has fields for internal addresses. They exist because the address your browser uses (public HTTPS) is not always the address the servers should use to reach each other inside the network. If both servers are on the same machine or LAN, giving the internal addresses there keeps server-to-server traffic local and avoids hairpin routing failures - a very common cause of documents that load for the admin at home but fail in the office, or the reverse.
Change the secret on a live system with care: every open editing session uses tokens signed with the old secret, so rotate it during quiet hours and expect users to reload their documents.
The video shows the connector settings screen and the secret field being filled - watch it alongside this page.
Watch Full VideoTypically a message that the document security token is not correctly formed, or the editor opens but refuses to save or edit. The fix is never a reinstall - re-paste the identical secret on both sides from one source and restart the Docs service.
Read it from the Docs server itself - from the container environment if you run Docker, or from local.json on a package install. If it is truly gone, set a new secret on the Docs side, paste the same value into the Nextcloud connector, and save during quiet hours.
Yes. It is a machine-to-machine key, not a login. Use a long random string you never type by hand, keep it in your password manager, and include it in your backup notes - a restore without the secret means re-pairing the two servers.