# Auth0 to validate Cloudflare JWT

**URL:** <https://community.auth0.com/t/auth0-to-validate-cloudflare-jwt/93334>\
**Category:** Get Help\
**Tags:** auth0-php\
**Created:** [October 29, 2022, 3:31am UTC](https://community.auth0.com/t/auth0-to-validate-cloudflare-jwt/93334 "2022-10-29T03:31:04Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![adamevers](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/adamevers/32/40899_2.png) [@adamevers](https://community.auth0.com/u/adamevers)\
**Post date:** [October 29, 2022, 3:31am UTC](https://community.auth0.com/t/auth0-to-validate-cloudflare-jwt/93334/1 "2022-10-29T03:31:04Z")

</div>

Hello!

I’ve been using the auth0 library to validate Cloudflare JWTs. I used [this](https://ntotten.com/2020/02/26/php-app-behind-cloudflare-access-with-jwt/) tutorial buttt it looks like it’s broken given the move from auth0-php v7 to v8 and I’m wondering if anyone could help me figure out how to update the code.

I wasn’t able to find a replacement for `AsymmetricVerifier` in v8.

Any suggestions?

---

<div class="post-metadata">

**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\
**Post date:** [October 31, 2022, 6:23pm UTC](https://community.auth0.com/t/auth0-to-validate-cloudflare-jwt/93334/3 "2022-10-31T18:23:39Z")

</div>

Hi @adamevers,

Welcome to the Auth0 Community!

Let me reach out to the maintainer and see if they can help.

cc: @evansims

---

<div class="post-metadata">

**Author:** ![evansims](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/evansims/32/27011_2.png) [@evansims](https://community.auth0.com/u/evansims)\
**Post date:** [October 31, 2022, 6:47pm UTC](https://community.auth0.com/t/auth0-to-validate-cloudflare-jwt/93334/4 "2022-10-31T18:47:36Z")

</div>

Hey @adamevers 👋 Thanks for reaching out, and welcome to the Community!

As you noticed, there were some pretty significant changes in the transition between v7 and v8 of the SDK — one of which was transitioning from using the underlying [lcobucci/jwt](https://github.com/lcobucci/jwt) library mentioned in that blog post, to using our own approach for token parsing/validation/verification.

I have not tried applying v8 of the PHP SDK to handling JWTs from Cloudflare specifically, so admittedly your mileage may vary, but, I can’t think of any specific reason why it shouldn’t handle them just fine offhand.

In SDK v8, you can use the `Auth0\SDK\Auth0::decode()` method to handle parsing, validating and verifying a token in one go. Here’s some example code for this process from the [EXAMPLES.md](https://github.com/auth0/auth0-PHP/blob/main/EXAMPLES.md#manually-decoding-tokens) file:

```php
use Auth0\SDK\Auth0;
use Auth0\SDK\Token;
use Auth0\SDK\Configuration\SdkConfiguration;

$configuration = new SdkConfiguration(
    strategy: SdkConfiguration::STRATEGY_API,
    domain: '...',
    clientId: '...',
    clientSecret: '..',
);

$auth0 = new Auth0($configuration);

$token = $auth0->decode(
    token: 'YOUR_ACCESS_TOKEN_HERE',
    tokenType: Token::TYPE_TOKEN, // This tells the SDK to treat the token as an Access Token, rather than ID Token.
    // ... other paramters are available, see the API reference:
    // ... https://auth0.github.io/auth0-PHP/classes/Auth0-SDK-Auth0.html#method_decode
);

print_r($token);

```

> It’s important to note that the SDK will use the information configured from `SdkConfiguration` in how it handles verifying the token signature and validating its claim. You may need to make overrides to the `decode()` method parameters for non-Auth0 JWT tokens, I’m not certain, to be honest.

If you need a little more control over the individual steps in your token handling, you can create an SDK `Token` instance yourself (e.g. `$token = new \Auth0\SDK\Token($sdkConfigurationInstance, $accessTokenString, \Auth0\SDK\Token::TYPE_TOKEN)` and then use the `$token->verify()` and `$token->validate()` methods on that class from there. Those methods have override parameters that may prove beneficial in handling non-Auth0 JWTs.

Please do let us know how it goes, I’d be curious to hear!

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [December 3, 2024, 2:52am UTC](https://community.auth0.com/t/auth0-to-validate-cloudflare-jwt/93334/5 "2024-12-03T02:52:18Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.