# Verify JWT token without knowing client id/secret

**URL:** <https://community.auth0.com/t/verify-jwt-token-without-knowing-client-id-secret/72670>\
**Category:** Get Help\
**Tags:** auth0-php\
**Created:** [November 5, 2021, 12:17pm UTC](https://community.auth0.com/t/verify-jwt-token-without-knowing-client-id-secret/72670 "2021-11-05T12:17:36Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![p.kruithof](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/p.kruithof/32/19110_2.png) [@p.kruithof](https://community.auth0.com/u/p.kruithof)\
**Post date:** [November 5, 2021, 12:17pm UTC](https://community.auth0.com/t/verify-jwt-token-without-knowing-client-id-secret/72670/1 "2021-11-05T12:17:36Z")

</div>

- **Which SDK this is regarding:** auth0-php
- **SDK Version:** 8.0.2
- **Platform Version:** 8.0.8
- **Code Snippets/Error Messages/Supporting Details/Screenshots:**

I’m implementing authentication for our own API using JWT. I’ve created an Auth0 API for this, and an Auth0 application that’s authorised to use it. Now, I’ve got the token validation/verification working:

```php
public function verify(string $jwt): array
{
    $token = new Token(
        configuration: $this->configuration,
        jwt: $jwt,
    );

    return $token
        ->verify()
        ->validate()
        ->toArray()
    ;
}

```

However, the configuration requires a client id/secret. Both are unknown (afaik) when you only have a JWT passed in the `Authorization` header of a request. For now I only have 1 application that authenticates this way, but the idea was that when we open up our API for external clients, we would create an Auth0 application for each client.

My question is: how do I verify a token when I don’t know what client it’s for?

---

<div class="post-metadata">

**Author:** ![john.gateley](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/john.gateley/32/10879_2.png) [@john.gateley](https://community.auth0.com/u/john.gateley)\
**Post date:** [November 5, 2021, 1:06pm UTC](https://community.auth0.com/t/verify-jwt-token-without-knowing-client-id-secret/72670/2 "2021-11-05T13:06:35Z")

</div>

Hi @p.kruithof

I am not sure where client ID/secret is required in PHP. It is not required to validate an access token. See: [https://auth0.com/docs/security/tokens/access-tokens/validate-access-tokens](https://auth0.com/docs/security/tokens/access-tokens/validate-access-tokens)

Basically, you need to get the signature verification key and validate the signature, that it is well formed, and that certain fields (like issuer, expiration etc.) are valid.

John

---

<div class="post-metadata">

**Author:** ![p.kruithof](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/p.kruithof/32/19110_2.png) [@p.kruithof](https://community.auth0.com/u/p.kruithof)\
**Post date:** [November 5, 2021, 1:22pm UTC](https://community.auth0.com/t/verify-jwt-token-without-knowing-client-id-secret/72670/3 "2021-11-05T13:22:34Z")

</div>

Hi John, thanks for the quick response. Based on your answer, I dug into the sdk source some more and found that the client secret was only needed when using the `HS256` signing algorithm (which we don’t use), so I was mistaken in that. The other thing was that for this use case, the `SdkConfiguration` that I used had no `strategy` key defined, which defaults to `webapp`, when instead it should be `api`. This way `client_id` is also not required anymore.

So that takes care of the problem, thanks! Maybe this post can help someone else out later with the same problem.

One last question: are the `verify()` and `validate()` calls enough to perform the checks you mentioned?

---

<div class="post-metadata">

**Author:** ![evansims](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/evansims/32/27011_2.png) [@evansims](https://community.auth0.com/u/evansims)\
**Post date:** [November 5, 2021, 3:22pm UTC](https://community.auth0.com/t/verify-jwt-token-without-knowing-client-id-secret/72670/4 "2021-11-05T15:22:53Z")

</div>

Hey @p.kruithof 👋 Looks good, `verify()` and `validate()` are all you’ll need there. It sounds like you’re working with Access Tokens rather than ID Tokens, right? If so, be sure to set the `type` during `Token` initialization to `Auth0\SDK\Token::TYPE_TOKEN` as it defaults to `TYPE_ID_TOKEN`. The validation checks are slightly different between the two.

---

<div class="post-metadata">

**Author:** ![p.kruithof](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/p.kruithof/32/19110_2.png) [@p.kruithof](https://community.auth0.com/u/p.kruithof)\
**Post date:** [November 5, 2021, 4:21pm UTC](https://community.auth0.com/t/verify-jwt-token-without-knowing-client-id-secret/72670/5 "2021-11-05T16:21:46Z")

</div>

Ah, I did not know that. Yes we do use access tokens, so I just changed that, thanks!

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [November 20, 2021, 4:22pm UTC](https://community.auth0.com/t/verify-jwt-token-without-knowing-client-id-secret/72670/6 "2021-11-20T16:22:47Z")

</div>

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.