# Verify Token
JWT Token is the only credential after the user logs in. There are five methods to verify the legitimacy of the Token and the user’s login status:
- [Local verification HS256 algorithm signature IdToken](#Use application key verification-token)
- [Local verification of the IdToken signed by the RS256 algorithm](#Using the application public key verification-rs256-algorithm-signed-idtoken)
- [Online Verification OIDC AccessToken](# Online Verification-oidc-accesstoken)
- [Online Verification OIDC IdToken](# Online Verification-oidc-idtoken)
- Online Verification OAuth2 AccessToken
Please select the method to verify the token based on the following information:
- If you directly call the login method (loginByEmail, loginByPhone, loginByUsername) or use OIDC authorization or want to verify the token field in the user information, please first look for the signature algorithm configuration of your application during authentication. If it is HS256, select The first way to verify, if it is RS256, choose the second way to verify;
- If you use the OIDC protocol to access other SaaS, and the SaaS wants to verify the token through the API, please use the third method;
- If you use the OIDC protocol and do not want to study how to verify the IdToken locally, please use the fourth method;
- If you use the OAuth 2.0 protocol, please use the fifth method;
# Use application key to verify Token
If you directly call the login method (loginByEmail, loginByPhone, loginByUsername) or use OIDC authorization, and the IdToken signature algorithm type is set to HS256, please use this method to verify Token.
The key can be obtained in the application details in the console, as shown in the following figure:
The following verification code takes Node as an example (you need to install jsonwebtoken).
const jwt = require('jsonwebtoken');
try {
let decoded = jwt.verify('JSON Web Token from client', 'your_secret'),
expired = Date.parse(new Date()) / 1000 > decoded.exp;
if (expired) {
// expired
} else {
// Legal and not expired, normal release
}
} catch (error) {
// illegal
}
To avoid exposing the application key on the client, it is recommended to verify the validity of id_token through the application key on the server.
If you don't know how to handle the callback of OIDC authorized login on the backend, please refer to the sample code on Github: oidc-demo (opens new window).
# Use the application public key to verify the IdToken signed by the RS256 algorithm
If you use the RS256 signature algorithm, you need to use the public key to verify the signature. Authing will use the application's private key to sign. Please use the public key in https://<application domain name>.authing.cn/oidc/.well-known/jwks.json to verify the signature. Both access_token and id_token issued by Authing can be verified with the above public key.
If you use javascript, you can use the jose library to verify the RS256 signature:
const jose = require('jose');
// The following parameter content is to copy the content returned from https://<application domain name>.authing.cn/oidc/.well-known/jwks.json intact
const keystore = jose.JWKS.asKeyStore({
keys: [
{
e: 'AQAB',
n:
'o8iCY52uBPOCnBSRCr3YtlZ0UTuQQ4NCeVMzV7JBtH-7Vuv0hwGJTb_hG-BeYOPz8i6YG_o367smV2r2mnXbC1cz_tBfHD4hA5vnJ1eCpKRWX-l6fYuS0UMti-Bmg0Su2IZxXF9T1Cu-AOlpgXFC1LlPABL4E0haHO8OwQ6QyEfiUIs0byAdf5zeEHFHseVHLjsM2pzWOvh5e_xt9NOJY4vB6iLtD5EIak04i1ND_O0Lz0OYbuV0KjluxaxoiexJ8kGo9W1SNza_2TqUAR6hsPkeOwwh-oHnNwZg8OEnwXFmNg-bW4KiBrQEG4yUVdFGENW6vAQaRa2bJX7obn4xCw',
kty: 'RSA',
alg: 'RS256',
use: 'sig',
kid: 'TfLOt3Lbn8_a8pRMuessamqj-o3DBCs1-owHLQ-VMqQ',
},
],
});
// The content of issuer in the option is https://<application domain name>.authing.cn/oidc, and the content of audience is the application ID
// id_token is very long, please swipe right ->
const res = jose.JWT.IdToken.verify(
'eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6IlRmTE90M0xibjhfYThwUk11ZXNzYW1xai1vM0RCQ3MxLW93SExRLVZNcVEifQ.eyJzdWIiOiI1ZjcxOTk0NjUyNGVlMTA5OTIyOTQ5NmIiLCJiaXJ0aGRhdGUiOm51bGwsImZhbWlseV9uYW1lIjpudWxsLCJnZW5kZXIiOiJVIiwiZ2l2ZW5fbmFtZSI6bnVsbCwibG9jYWxlIjpudWxsLCJtaWRkbGVfbmFtZSI6bnVsbCwibmFtZSI6bnVsbCwibmlja25hbWUiOm51bGwsInBpY3R1cmUiOiJodHRwczovL2ZpbGVzLmF1dGhpbmcuY28vdXNlci1jb250ZW50cy9waG90b3MvOWE5ZGM0ZDctZTc1Ni00NWIxLTgxZDgtMDk1YTI4ZTQ3NmM2LmpwZyIsInByZWZlcnJlZF91c2VybmFtZSI6InRlc3QxIiwicHJvZmlsZSI6bnVsbCwidXBkYXRlZF9hdCI6IjIwMjAtMDktMzBUMDc6MTI6MTkuNDAxWiIsIndlYnNpdGUiOm51bGwsInpvbmVpbmZvIjpudWxsLCJlbWFpbCI6InRlc3QxQDEyMy5jb20iLCJlbWFpbF92ZXJpZmllZCI6ZmFsc2UsInBob25lX251bWJlciI6bnVsbCwicGhvbmVfbnVtYmVyX3ZlcmlmaWVkIjpmYWxzZSwibm9uY2UiOiJFNjViMVFvVVl0IiwiYXRfaGFzaCI6IkIzSWdPWUREYTBQejh2MV85cVpyQXciLCJhdWQiOiI1ZjE3YTUyOWY2NGZiMDA5Yjc5NGEyZmYiLCJleHAiOjE2MDE0NTM1NTgsImlhdCI6MTYwMTQ0OTk1OSwiaXNzIjoiaHR0cHM6Ly9vaWRjMS5hdXRoaW5nLmNuL29pZGMifQ.Z0TweYr9bCdYNJREVdvbJYcjXSfSsSNHBMqxTJeW-bnza0IIpBpEEVxlDG0Res6FZbcVzsQZzfJ9pj_nFgLjZxUUxv7Tpd13Sq_Ykg2JKepPf3-uoFqbORym07QEj4Uln0Quuh094MTb7z6bZZBEOYBac46zuj4uVp4vqk5HtCUSB4ASOAxwi7CeB1tKghISHz6PDcf6XJe_btHdzX1dparxtML-KvPxjpcHlt5emN88lpTAOX7Iq0EhsVE3PKrIDfCkG8XlL5y9TIW2Dz2iekcZ5PV17M35G6Dg2Q07Y_Apr18_oowOiQM5m_EbI90ist8CiqO9kBKreCOLMzub4Q',
keystore,
{
issuer: 'https://oidc1.authing.cn/oidc',
audience: '5f17a529f64fb009b794a2ff',
}
);
console.log(res);
Output result:
{
sub: '5f719946524ee1099229496b',
birthdate: null,
family_name: null,
gender: 'U',
given_name: null,
locale: null,
middle_name: null,
name: null,
nickname: null,
picture: 'https://files.authing.co/user-contents/photos/9a9dc4d7-e756-45b1-81d8-095a28e476c6.jpg',
preferred_username: 'test1',
profile: null,
updated_at: '2020-09-30T07:12:19.401Z',
website: null,
zoneinfo: null,
email: 'test1@123.com',
email_verified: false,
phone_number: null,
phone_number_verified: false,
nonce: 'E65b1QoUYt',
at_hash: 'B3IgOYDDa0Pz8v1_9qZrAw',
aud: '5f17a529f64fb009b794a2ff',
exp: 1601453558,
iat: 1601449959,
iss: 'https://oidc1.authing.cn/oidc'
}
# Online verification OIDC AccessToken
Check token status
Only access_token and refresh_token can be checked status, id_token cannot be checked.
# Online verification OIDC IdToken
Verify the validity of access_token / id_token online
Authing provides an interface to directly verify the validity of access_token or id_token online.
# Online verification OAuth2 AccessToken
Check token status
You can check the status of access_token.