Authentication
The backend verifies Web3Auth idToken JWTs on every authenticated request.
Verification Steps
- Extract
Authorization: Bearer <idToken>header - Decode the JWT header to find the
kid - Preferred: verify against the project’s static PEM public key (
WEB3AUTH_VERIFICATION_KEY) - Fallback: fetch the JWKS from
JWKS_ENDPOINTand match thekid - Validate: signature, expiry, issuer, audience
Devnet Mode
When WEB3AUTH_ALLOW_UNVERIFIED=true (for Sapphire Devnet):
- Skips the signature check
- Still enforces audience, issuer, and expiry
WEB3AUTH_ALLOW_UNVERIFIED must be false on mainnet, where the JWKS endpoint works correctly.
Configuration
| Env Var | Purpose | Default |
|---|---|---|
WEB3AUTH_CLIENT_ID | Token audience check | — |
WEB3AUTH_VERIFICATION_KEY | Static PEM public key | — |
JWKS_ENDPOINT | JWKS URL | https://api-auth.web3auth.io/.well-known/jwks.json |
WEB3AUTH_ALLOW_UNVERIFIED | Skip signature (devnet only) | false |
Last updated on