Function looksLikeJWT

server/src/auth/workos-jwt.ts:74–78

(token: string)

 * JWTs from opaque API keys without attempting signature verification.
 */
export function looksLikeJWT(token: string): boolean {
  const parts = token.split('.');
  if (parts.length !== 3) return false;
  return parts.every((p) => p.length > 0 && /^[A-Za-z0-9_-]+$/.test(p));
}

/**
 * Verify a WorkOS-signed JWT. Throws on any verification failure