# Basic question about resolving a token **URL:** \ **Category:** Get Help\ **Tags:** new-universal-login-experience, login-experience\ **Created:** [April 28, 2023, 4:17pm UTC](https://community.auth0.com/t/basic-question-about-resolving-a-token/105758 "2023-04-28T16:17:00Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![kkrp1](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@kkrp1](https://community.auth0.com/u/kkrp1)\ **Post date:** [April 28, 2023, 4:17pm UTC](https://community.auth0.com/t/basic-question-about-resolving-a-token/105758/1 "2023-04-28T16:17:01Z")
I’ve read a tonne of documentation and somehow I’m still a little unsure precisely what I should recall on my back-end (using the Node.js SDK) to resolve a passed user token (i.e. the token that is the result of a successful universal login). In the docs for the SDK there’s the `getProfile` method - is this the authoritative source of whether a token is valid, or is there some other method/endpoint I should be calling? Many thanks. ---
**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\ **Post date:** [April 28, 2023, 11:42pm UTC](https://community.auth0.com/t/basic-question-about-resolving-a-token/105758/3 "2023-04-28T23:42:47Z")
Hey @kkrp1! > [@kkrp1](#): > > In the docs for the SDK there’s the `getProfile` method - is this the authoritative source of whether a token is valid, or is there some other method/endpoint I should be calling? Assuming you are working on your backend, you will be concerned with validating an access token. I definitely recommend checking out [this library](https://github.com/auth0/node-oauth2-jwt-bearer). This blog post should be helpful as well: > **[Introducing the OAuth 2.0 Express SDK for Protecting APIs with JWT Bearer Tokens](https://auth0.com/blog/introducing-oauth2-express-sdk-protecting-api-with-jwt/)** > > Learn how the OAuth 2.0 Express SDK released by Auth0 makes protecting your Express API easier. Cheers! ---
**Author:** ![kkrp1](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@kkrp1](https://community.auth0.com/u/kkrp1)\ **Post date:** [April 29, 2023, 10:24am UTC](https://community.auth0.com/t/basic-question-about-resolving-a-token/105758/4 "2023-04-29T10:24:24Z")
Thanks. I’m just trying to figure out the back-end part of the flow. I’m really new to all this and haven’t used JWT before. So are you saying that my back-end, on being passed an auth token (i.e. a JWT), should first validate it with the library you linked to, and then call the `getProfile` endpoint on Auth0? Is it these TWO steps which, combined, constitute the successful confirmation that a JWT represents an authenticated user, or just the first (the second (get profile) being necessary only if you actually want the profile details)? Wouldn’t merely calling `getProfile` suffice, without validating the JWT first? I’m speaking from total ignorance here so this is probably a terrible idea, but I’m just trying to get it clear in my head. Surely if I do nothing other than try to get profile, that either succeeds (the JWT was valid) or fails (it wasn’t), ergo that step alone constitutes validating the token? I realise I’m asking some real basics here so I appreciate your patience and help! ---
**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\ **Post date:** [May 2, 2023, 1:54am UTC](https://community.auth0.com/t/basic-question-about-resolving-a-token/105758/5 "2023-05-02T01:54:41Z")
No problem, happy to help! > [@kkrp1](#): > > Wouldn’t merely calling `getProfile` suffice, without validating the JWT first? Technically speaking, because `getProfile` does require a valid access (it’ll throw an error if not) it could serve as a rudimentary check on the access token. It is just not best practice as it does more than just validate the token - Validating the token first and then performing subsequent actions makes more sense as your use case becomes more complex (as opposed to relying on `getProfile`). Hope this helps to clarify! ---
**Author:** ![kkrp1](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@kkrp1](https://community.auth0.com/u/kkrp1)\ **Post date:** [May 2, 2023, 10:11am UTC](https://community.auth0.com/t/basic-question-about-resolving-a-token/105758/6 "2023-05-02T10:11:18Z")
Thank you! So just to wrap this up, you’re saying I should _first_ validate the JWT, using the library you mentioned. When I do this, could you clarify what precisely I’m looking for in that validation? Am I checking for a particular item in the decoded token? And _only then_, if we pass that stage, do I call `getProfile()`, right? Continued thanks! ---
**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\ **Post date:** [May 2, 2023, 9:00pm UTC](https://community.auth0.com/t/basic-question-about-resolving-a-token/105758/7 "2023-05-02T21:00:56Z")
Linking to the post below as I believe it answers this question as well: > [@JWT token is "invalid signature"?](https://community.auth0.com/t/jwt-token-is-invalid-signature/105796/5): > > Hey @kkrp1 ! Again, this all comes down to the audience - This would be passed to getTokenSilently via [authorizationParams](https://auth0.github.io/auth0-spa-js/interfaces/GetTokenSilentlyOptions.html#authorizationParams). If the only thing you are doing is using the access token to call /userinfo then you are correct in that you do not need an audience, nor do you need to validate the token per se. In most cases, the access token is used to access an API (your API) and in that case you’d want a JWT to inspect which does require an audience (your API identifier in Auth0) as you’ve seen. Hopefully this clears things up for you 🙂 ---
**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\ **Post date:** [May 16, 2023, 9:00pm UTC](https://community.auth0.com/t/basic-question-about-resolving-a-token/105758/8 "2023-05-16T21:00:57Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.