Verify a user's JWT in your backend

import { createRemoteJWKSet, jwtVerify } from 'jose'

const PROJECT_URL = process.env.AURABASE_URL! // https://<slug>.aurabase.cloud
const PROJECT_ID = process.env.AURABASE_PROJECT_ID!

// jose caches the keys and refetches when it meets an unknown kid (rotation).
const jwks = createRemoteJWKSet(new URL(`${PROJECT_URL}/.well-known/jwks.json`))

export async function verifyAccessToken(token: string) {
  const { payload } = await jwtVerify(token, jwks, {
    issuer: `${PROJECT_URL}/v1/auth`,
    audience: PROJECT_ID,
    algorithms: ['ES256'],
  })
  return payload // payload.sub is the user id
}

import os
import jwt  # pip install "pyjwt[crypto]"

PROJECT_URL = os.environ["AURABASE_URL"]
PROJECT_ID = os.environ["AURABASE_PROJECT_ID"]
jwks = jwt.PyJWKClient(f"{PROJECT_URL}/.well-known/jwks.json")

def verify_access_token(token: str) -> dict:
    key = jwks.get_signing_key_from_jwt(token).key
    return jwt.decode(
        token,
        key,
        algorithms=["ES256"],
        issuer=f"{PROJECT_URL}/v1/auth",
        audience=PROJECT_ID,
    )

package main

import (
	"fmt"
	"os"

	"github.com/MicahParks/keyfunc/v3"
	"github.com/golang-jwt/jwt/v5"
)

func verify(token string) (jwt.MapClaims, error) {
	projectURL := os.Getenv("AURABASE_URL")
	jwks, err := keyfunc.NewDefault([]string{projectURL + "/.well-known/jwks.json"})
	if err != nil {
		return nil, err
	}
	claims := jwt.MapClaims{}
	_, err = jwt.ParseWithClaims(token, claims, jwks.Keyfunc,
		jwt.WithValidMethods([]string{"ES256"}),
		jwt.WithIssuer(projectURL+"/v1/auth"),
		jwt.WithAudience(os.Getenv("AURABASE_PROJECT_ID")),
	)
	if err != nil {
		return nil, fmt.Errorf("invalid token: %w", err)
	}
	return claims, nil
}