Verifying access tokens

builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme).AddJwtBearer(options =>
{
    // Your app's own authority: finds its keys through /.well-known/openid-configuration below it,
    // caches them, and fetches them again when a token names a key it hasn't seen
    options.Authority = $"https://api.identise.com/apps/{identise.AppId}";
    options.MapInboundClaims = false;
    options.TokenValidationParameters = new TokenValidationParameters
    {
        ValidIssuer = identise.Issuer,
        ValidAudience = identise.AppId,
        ValidAlgorithms = [SecurityAlgorithms.RsaSha256],
        ClockSkew = TimeSpan.Zero
    };
});

import { createRemoteJWKSet, jwtVerify } from "jose";

// Your app's own keys: fetched on first use, cached, and fetched again when a token names a key it hasn't seen
const identiseKeys = createRemoteJWKSet(
    new URL(`https://api.identise.com/apps/${process.env.IDENTISE_APP_ID}/.well-known/jwks.json`),
);

export async function verifyIdentiseToken(token: string) {
    const { payload } = await jwtVerify(token, identiseKeys, {
        algorithms: ["RS256"],
        audience: process.env.IDENTISE_APP_ID,
        issuer: process.env.IDENTISE_ISSUER,
    });
    return { userId: payload.sub!, email: payload.email as string, emailVerified: payload.email_verified === "true" };
}

import jwt

identise_keys = jwt.PyJWKClient(f"https://api.identise.com/apps/{IDENTISE_APP_ID}/.well-known/jwks.json")

def verify_identise_token(token):
    key = identise_keys.get_signing_key_from_jwt(token)
    return jwt.decode(token, key.key, algorithms=["RS256"], audience=IDENTISE_APP_ID, issuer=IDENTISE_ISSUER)