How To
Verify Signatures
We send a JWT with each request. This JWT is signed by your individual secret
signing keys and sent in the Upstash-Signature
HTTP header.
To verify the jwt you can choose from a wide array of open source libraries, or roll your own solution.
Claims
All claims in the JWT are listed here
Verifying
The exact implementation depends on the language of your choice and the library if you use one.
Instead here are the steps you need to follow:
- Split the JWT into its header, payload and signature
- Verify the signature
- Decode the payload and verify the claims
iss
: The issuer must beUpstash
.sub
: The subject must the url of your API.exp
: Verify the token has not expired yet.nbf
: Verify the token is already valid.body
: Hash the raw request body usingSHA-256
and compare it with thebody
claim.
You can also reference the implementation in our typescript sdk or use the methods provided in the SDKs:
In JavaScript, the body could be presented by an object via the HTTP handler if it is a JSON. Don’t forget to convert to string first via JSON.stringify(body)
After you have verified the signature and the claims, you can be sure the request came from Upstash and process it accordingly.
Was this page helpful?