# How to verify the jsonwebtoken?

**URL:** <https://forums.eveonline.com/t/how-to-verify-the-jsonwebtoken/230429>\
**Category:** Third Party Developers\
**Created:** [April 6, 2020, 9:02pm UTC](https://forums.eveonline.com/t/how-to-verify-the-jsonwebtoken/230429 "2020-04-06T21:02:17Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ishi\_La](https://sea1.discourse-cdn.com/eveonline/user_avatar/forums.eveonline.com/ishi_la/32/194549_2.png) [@Ishi\_La](https://forums.eveonline.com/u/Ishi_La)\
**Post date:** [April 6, 2020, 9:02pm UTC](https://forums.eveonline.com/t/how-to-verify-the-jsonwebtoken/230429/1 "2020-04-06T21:02:17Z")

</div>

Hey,

I managed to get the access\_token I need. Now I need to verify the access\_token. As in: [https://docs.esi.evetech.net/docs/sso/validating\_eve\_jwt.html](https://docs.esi.evetech.net/docs/sso/validating_eve_jwt.html) . But I can’t really figure out what I am supposed to do. I did install a node package. Which provides me with a verify method: [https://github.com/auth0/node-jsonwebtoken#jwtverifytoken-secretorpublickey-options-callback](https://github.com/auth0/node-jsonwebtoken#jwtverifytoken-secretorpublickey-options-callback)

I can’t seem to figure out what arguments to put in. And the docs aren’t helping a Iot either. I assume the first argument is the access\_token, is the second my client\_secret? And the third, what setting should I pass?

Of course I can proceed without this verification-step, but I’d rather not.

---

<div class="post-metadata">

**Author:** ![Blacksmoke16](https://sea1.discourse-cdn.com/eveonline/user_avatar/forums.eveonline.com/blacksmoke16/32/376589_2.png) [@Blacksmoke16](https://forums.eveonline.com/u/Blacksmoke16)\
**Post date:** [April 6, 2020, 10:12pm UTC](https://forums.eveonline.com/t/how-to-verify-the-jsonwebtoken/230429/2 "2020-04-06T22:12:22Z")

</div>

I think you would need to reference this example:

> // Verify using getKey callback  
> // Example uses [GitHub - auth0/node-jwks-rsa: A library to retrieve RSA public keys from a JWKS (JSON Web Key Set) endpoint.](https://github.com/auth0/node-jwks-rsa) as a way to fetch the keys.  
> var jwksClient = require(‘jwks-rsa’);  
> var client = jwksClient({  
> jwksUri: ‘[https://sandrino.auth0.com/.well-known/jwks.json](https://sandrino.auth0.com/.well-known/jwks.json)’  
> });  
> function getKey(header, callback){  
> client.getSigningKey(header.kid, function(err, key) {  
> var signingKey = key.publicKey || key.rsaPublicKey;  
> callback(null, signingKey);  
> });  
> }
> 
> jwt.verify(token, getKey, options, function(err, decoded) {  
> console.log(decoded.foo) // bar  
> });

Where in our case the `jwksUri` would be [https://login.eveonline.com/oauth/jwks](https://login.eveonline.com/oauth/jwks) as mentioned in step #1.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/eveonline/original/3X/4/1/41ec4921cbaca7a6f9ea556e7cc20018461eae5e.png) [@system](https://forums.eveonline.com/u/system)\
**Post date:** [July 5, 2020, 10:12pm UTC](https://forums.eveonline.com/t/how-to-verify-the-jsonwebtoken/230429/3 "2020-07-05T22:12:28Z")

</div>

This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.