Why do I need a private key to verify a JWT?

[tyf]

Hey there @okneloper !

@okneloper

Ok, it looks like I actually can verify a token with just the public key (which was my main concern), but still curious why jwt.io requires a private key. This is pretty confusing.

Thanks for following up on this - I agree the language there is a bit confusing FWIW if you are using RS256 jwt.io should automatically verify the signature for you without having to paste in your public key at all. It does this by using the issuer iss claim to call the jwks endpoint and use the public key from there.