Verify JWT

How to verify JWT tokens transmitted from the frontend in the backend and retrieve the user payload

Note: You must install jose in your project before getting started.

npm add jose

1. Frontend adds token to request headers

The access token is stored under the vuer_token key after sign-in. Send it as a Bearer token:

const token = localStorage.getItem("vuer_token");

fetch("https://your-api.example.com/secure", {
  headers: {
    Authorization: `Bearer ${token}`,
  },
}).then((res) => {
  // Your processing logic is here.
  console.log(res.ok);
});

2. Backend retrieves JWT keys from vuer-auth

The public keys are published at /.well-known/jwks.json.

import { JSONWebKeySet } from "jose";

const response = await fetch("https://staging-auth.vuer.ai/.well-known/jwks.json");

if (!response.ok) {
  // Handle the error logic here.
} else {
  // Store the JWKS within your program.
  const jwks = (await response.json()) as JSONWebKeySet;
  console.log(jwks);
}

3. Backend parses JWT token sent from frontend using the keys

The recommended approach uses createRemoteJWKSet, which fetches the keys, caches them, and automatically refreshes on key rotation. Create it once at module scope, not per request.

import { createRemoteJWKSet, jwtVerify } from "jose";

// Create once, at module scope — handles caching and key rotation.
const JWKS = createRemoteJWKSet(
  new URL("https://staging-auth.vuer.ai/.well-known/jwks.json"),
);

interface User {
  sub: string;
  email: string;
  name: string;
  username: string;
  email_verified: boolean;
}

// `token` is the Bearer token sent from the frontend.
const { payload } = await jwtVerify<User>(token, JWKS, {
  algorithms: ["EdDSA"], // vuer-auth signs with Ed25519 — always pin this
});

// The `payload` contains the user-related information.
console.log(payload);

If your backend cannot reach vuer-auth at runtime, fetch the JWKS yourself (as in step 2) and use createLocalJWKSet(jwks) instead — but re-fetch periodically to pick up key rotation.