diff --git a/.cproject b/.cproject
index 42741a9..ae0fdc4 100644
--- a/.cproject
+++ b/.cproject
@@ -18,7 +18,7 @@
 				</extensions>
 			</storageModule>
 			<storageModule moduleId="cdtBuildSystem" version="4.0.0">
-				<configuration artifactName="${ProjName}" buildArtefactType="org.eclipse.linuxtools.cdt.autotools.core.buildArtefactType.autotools" buildProperties="org.eclipse.cdt.build.core.buildArtefactType=org.eclipse.linuxtools.cdt.autotools.core.buildArtefactType.autotools,org.eclipse.cdt.build.core.buildType=org.eclipse.linuxtools.cdt.autotools.core.buildType.default" cleanCommand="rm -rf" description="" errorParsers="org.eclipse.cdt.core.CWDLocator;org.eclipse.cdt.core.GmakeErrorParser;org.eclipse.cdt.core.GCCErrorParser;org.eclipse.cdt.core.GLDErrorParser;org.eclipse.cdt.core.GASErrorParser" id="org.eclipse.linuxtools.cdt.autotools.core.configuration.build.1562680719" name="Build (GNU)" optionalBuildProperties="org.eclipse.cdt.docker.launcher.containerbuild.property.volumes=,org.eclipse.cdt.docker.launcher.containerbuild.property.connection=unix:///var/run/docker.sock,org.eclipse.cdt.docker.launcher.containerbuild.property.selectedvolumes=" parent="org.eclipse.linuxtools.cdt.autotools.core.configuration.build">
+				<configuration artifactName="${ProjName}" buildArtefactType="org.eclipse.linuxtools.cdt.autotools.core.buildArtefactType.autotools" buildProperties="org.eclipse.cdt.build.core.buildArtefactType=org.eclipse.linuxtools.cdt.autotools.core.buildArtefactType.autotools,org.eclipse.cdt.build.core.buildType=org.eclipse.linuxtools.cdt.autotools.core.buildType.default" cleanCommand="rm -rf" description="" errorParsers="org.eclipse.cdt.core.CWDLocator;org.eclipse.cdt.core.GmakeErrorParser;org.eclipse.cdt.core.GCCErrorParser;org.eclipse.cdt.core.GLDErrorParser;org.eclipse.cdt.core.GASErrorParser" id="org.eclipse.linuxtools.cdt.autotools.core.configuration.build.1562680719" name="Build (GNU)" optionalBuildProperties="org.eclipse.cdt.docker.launcher.containerbuild.property.selectedvolumes=,org.eclipse.cdt.docker.launcher.containerbuild.property.volumes=,org.eclipse.cdt.docker.launcher.containerbuild.property.connection=unix:///var/run/docker.sock" parent="org.eclipse.linuxtools.cdt.autotools.core.configuration.build">
 					<folderInfo id="org.eclipse.linuxtools.cdt.autotools.core.configuration.build.1562680719." name="/" resourcePath="">
 						<toolChain id="org.eclipse.linuxtools.cdt.autotools.core.toolChain.617277945" name="GNU Autotools Toolchain" superClass="org.eclipse.linuxtools.cdt.autotools.core.toolChain">
 							<targetPlatform id="org.eclipse.linuxtools.cdt.autotools.core.toolchain.targetPlatform.359991688" isAbstract="false" name="GNU Autotools Target Platform" superClass="org.eclipse.linuxtools.cdt.autotools.core.toolchain.targetPlatform"/>
@@ -34,7 +34,7 @@
 							<tool id="org.eclipse.linuxtools.cdt.autotools.core.toolchain.tool.gcc.548331172" name="GCC C Compiler" superClass="org.eclipse.linuxtools.cdt.autotools.core.toolchain.tool.gcc">
 								<option IS_BUILTIN_EMPTY="false" IS_VALUE_EMPTY="false" id="gnu.c.compiler.option.include.paths.811285626" name="Include paths (-I)" superClass="gnu.c.compiler.option.include.paths" useByScannerDiscovery="false" valueType="includePath">
 									<listOptionValue builtIn="false" value="&quot;${workspace_loc:/liboauth2/include}&quot;"/>
-									<listOptionValue builtIn="false" value="/opt/local/include"/>
+									<listOptionValue builtIn="false" value="/opt/homebrew/include"/>
 									<listOptionValue builtIn="false" value="/Users/hzandbelt/projects/nginx/src/core"/>
 									<listOptionValue builtIn="false" value="/Users/hzandbelt/projects/nginx/src/http"/>
 									<listOptionValue builtIn="false" value="/Users/hzandbelt/projects/nginx/src/os/unix"/>
diff --git a/ChangeLog b/ChangeLog
index fac7504..6a92ce6 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+09/16/2024
+- add JWT handler wih optional JQ filtering in liboauth2-sts 4.1.0dev
+- depend on liboauth2 >= 2.1.0
+- bump to 4.1.0dev
+
 08/22/2024
 - change LICENSE to Apache 2.0
 - depend on liboauth2 >= 2.0.0
diff --git a/Makefile.am b/Makefile.am
index f671f7d..5004979 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -26,6 +26,7 @@ pkglibdir = $(libdir)/nginx/modules
 	src/liboauth2-sts/src/ropc.c \
 	src/liboauth2-sts/src/cc.c \
 	src/liboauth2-sts/src/otx.c \
+	src/liboauth2-sts/src/jwt.c \
 	src/@PACKAGE_NAME@.c \
 	src/@PACKAGE_NAME@_modules.c
 @PACKAGE_NAME@_la_LDFLAGS = -module
diff --git a/configure.ac b/configure.ac
index c4c8be0..3276566 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1,4 +1,4 @@
-AC_INIT([ngx_sts_module],[4.0.0],[hans.zandbelt@openidc.com])
+AC_INIT([ngx_sts_module],[4.1.0dev],[hans.zandbelt@openidc.com])
 
 AM_INIT_AUTOMAKE([foreign no-define subdir-objects])
 AC_CONFIG_MACRO_DIRS([m4])
@@ -25,11 +25,11 @@ AM_CONDITIONAL(HAVE_NGINX, [test x"$have_nginx" = "xyes"])
 AC_SUBST(NGINX_CFLAGS)
 AC_SUBST(NGINX_LIBS)
 
-PKG_CHECK_MODULES(OAUTH2, [liboauth2 >= 2.0.0])
+PKG_CHECK_MODULES(OAUTH2, [liboauth2 >= 2.1.0])
 AC_SUBST(OAUTH2_CFLAGS)
 AC_SUBST(OAUTH2_LIBS)
 
-PKG_CHECK_MODULES(OAUTH2_NGINX, [liboauth2_nginx >= 2.0.0])
+PKG_CHECK_MODULES(OAUTH2_NGINX, [liboauth2_nginx >= 2.1.0])
 AC_SUBST(OAUTH2_NGINX_CFLAGS)
 AC_SUBST(OAUTH2_NGINX_LIBS)
 
diff --git a/src/liboauth2-sts b/src/liboauth2-sts
index db142c3..9b535a0 160000
--- a/src/liboauth2-sts
+++ b/src/liboauth2-sts
@@ -1 +1 @@
-Subproject commit db142c38fb07674e420996ed7223a00c9b04e8ab
+Subproject commit 9b535a0396d86eb6759dcb5948c1ae4eb328c809
diff --git a/src/ngx_sts_module.c b/src/ngx_sts_module.c
index 62e5492..e9db97f 100644
--- a/src/ngx_sts_module.c
+++ b/src/ngx_sts_module.c
@@ -117,13 +117,13 @@ OAUTH2_NGINX_CFG_FUNC_ARGS1(sts, ngx_sts_config, passphrase,
 			    oauth2_crypto_passphrase_set, NULL)
 OAUTH2_NGINX_CFG_FUNC_ARGS2(sts, ngx_sts_config, cache, oauth2_cfg_set_cache,
 			    NULL)
-OAUTH2_NGINX_CFG_FUNC_ARGS3(sts, ngx_sts_config, exchange, sts_cfg_set_exchange,
+OAUTH2_NGINX_CFG_FUNC_ARGS4(sts, ngx_sts_config, exchange, sts_cfg_set_exchange,
 			    cfg->cfg)
 
 static ngx_command_t ngx_sts_commands[] = {
     OAUTH2_NGINX_CMD(1, sts, STSCryptoPassphrase, passphrase),
     OAUTH2_NGINX_CMD(12, sts, STSCache, cache),
-    OAUTH2_NGINX_CMD(3 | NGX_CONF_TAKE4, sts, STSExchange, exchange),
+    OAUTH2_NGINX_CMD(3 | NGX_CONF_TAKE5, sts, STSExchange, exchange),
     OAUTH2_NGINX_CMD(2, sts, "STSVariables", variables), ngx_null_command};
 
 static void ngx_sts_cleanup(void *data)