The answer is Yes, BearerAuthSecurity has a constructor that looks like is doing it:

constructor(key: RequestContextLens<Any>, lookup: (String) -> Any?, name: String = "bearerAuth")

But the problem I got with that is that it requires a <Any> if I try to use a lens:

val credentials = RequestContextKey.required<Credentials>(contexts)

I get a:

Type mismatch.
Required:
RequestContextLens<Any> /* = BiDiLens<Request, Any> */
Found:
RequestContextLens<Credentials> /* = BiDiLens<Request, Credentials> */

Declaring the Lens as

Any

and then doing an

as

when using the Lens works.

val credentials = RequestContextKey.required<Any>(contexts)

...
val handler: HttpHandler = { request ->
    val user = credentials(request) as? Credentials
    ...
}
...

meta {
   ...
   security = BearerAuthSecurity(key = credentials, User::fromJwtClaims)
   ...
}

You may need to override the securotyrenderer as well to get it to render correctly in the openapidocs