Function verifyWorkOSJWT

server/src/auth/workos-jwt.ts:92–126

(token: string)

 * signature verification against our shared JWKS.
 */
export async function verifyWorkOSJWT(token: string): Promise<VerifiedWorkOSToken> {
  const jwksInstance = getJWKS();

  const { payload } = await jwtVerify(token, jwksInstance);

  const azp = typeof payload.azp === 'string' ? payload.azp : undefined;
  const clientIdClaim =
    typeof payload.client_id === 'string' ? payload.client_id : undefined;
  const applicationId = azp ?? clientIdClaim;
  if (!applicationId || applicationId !== workosClientId()) {
    throw new Error(
      `Token application id ("${applicationId ?? 'missing'}") does not match this application`,
    );
  }

  const sub = typeof payload.sub === 'string' ? payload.sub : '';
  const isM2M =
    payload.grant_type === 'client_credentials' || sub.startsWith('client_');

  const scopes =
    typeof payload.scope === 'string'
      ? payload.scope.split(' ').filter(Boolean)
      : [];

  return {
    sub,
    clientId: applicationId,
    email: typeof payload.email === 'string' ? payload.email : undefined,
    orgId: typeof payload.org_id === 'string' ? payload.org_id : undefined,
    isM2M,
    scopes,
    expiresAt: typeof payload.exp === 'number' ? payload.exp : undefined,
    payload,
  };
}