JWT verification

Method 1) Using JWKS endpoint#

Some libraries let you provide a JWKS endpoint to verify a JWT. The JWKS endpoint exposed by SuperTokens is availble at the following URL:

curl --location --request GET '<YOUR_API_DOMAIN>/auth/jwt/jwks.json'

Below is an example for NodeJS showing how you can use jsonwebtoken and jwks-rsa together to achieve JWT verification using the jwks.json endpoint.

import JsonWebToken, { JwtHeader, SigningKeyCallback } from 'jsonwebtoken';import jwksClient from 'jwks-rsa';
var client = jwksClient({  jwksUri: '<YOUR_API_DOMAIN>/auth/jwt/jwks.json'});
function getKey(header: JwtHeader, callback: SigningKeyCallback) {  client.getSigningKey(header.kid, function (err, key) {    var signingKey = key!.getPublicKey();    callback(err, signingKey);  });}
let jwt = "...";JsonWebToken.verify(jwt, getKey, {}, function (err, decoded) {  let decodedJWT = decoded;  // Use JWT});

Method 2) Using public key string#

Some JWT verification libraries require you to provide the JWT secret / public key for verification. You can obtain the JWT secret from SuperTokens in the following way:

First, we query the JWKS.json endpoint:

curl --location --request GET '<YOUR_API_DOMAIN>/auth/jwt/jwks.json'
{  "keys": [    {      "kty": "RSA",      "kid": "2de612a5-a5ba-413e-9216-4c43e2e78c86",      "n": "AMZruthvYz7Ft-Dp0BC_SEEJaWK91s_YA-RR81iLJ6BTT6gJp0CcV4DfBynFU_59dRGOZyVQpAW6Drnc_6LyZpVWHROzqt-Fjh8TAqodayhPJVuZt25eQiYrqcaK_dnuHrm8qwUq-hko6q1o1o9NIIZWNfUBEVWmNhyAJFk5bi3pLwtKPYrUQzVLcTdDUe4SIltvvfpYHbVFnYtxkBVmqO68j7sI8ktmTXM_heals-W6WmozabDkC9_ITCeRat2f7A2l0t4QzO0ZCzZcJfhusF4X1niKgY6yYXpbX6is4HCfhYfdabcE52xYMNl-gw9XDjsIxfBMUDvOFRHWlx0rU8c=",      "e": "AQAB",      "alg": "RS256",      "use": "sig"    }  ]}

Next, we run the NodeJS script below to convert the above output to a PEM file format.

import jwkToPem from 'jwk-to-pem';
// This JWK is copied from the result of the above SuperTokens core requestlet jwk = {  "kty": "RSA",  "kid": "2de612a5-a5ba-413e-9216-4c43e2e78c86",  "n": "AMZruthvYz7Ft-Dp0BC_SEEJaWK91s_YA-RR81iLJ6BTT6gJp0CcV4DfBynFU_59dRGOZyVQpAW6Drnc_6LyZpVWHROzqt-Fjh8TAqodayhPJVuZt25eQiYrqcaK_dnuHrm8qwUq-hko6q1o1o9NIIZWNfUBEVWmNhyAJFk5bi3pLwtKPYrUQzVLcTdDUe4SIltvvfpYHbVFnYtxkBVmqO68j7sI8ktmTXM_heals-W6WmozabDkC9_ITCeRat2f7A2l0t4QzO0ZCzZcJfhusF4X1niKgY6yYXpbX6is4HCfhYfdabcE52xYMNl-gw9XDjsIxfBMUDvOFRHWlx0rU8c=",  "e": "AQAB",  "alg": "RS256",  "use": "sig"};
let certString = jwkToPem(jwk);

The above snippet would generate the following certificate string:

Now you can use the generated PEM string in your code like shown below:

import JsonWebToken from 'jsonwebtoken';
// Truncated for displaylet certificate = "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhki...\n-----END PUBLIC KEY-----";let jwt = "...";JsonWebToken.verify(jwt, certificate, function (err, decoded) {    let decodedJWT = decoded;    // Use JWT});