JWKS

1
import { Gwop } from "@gwop/sdk";
2
3
const gwop = new Gwop({
4
  merchantApiKey: process.env.GWOP_MERCHANT_API_KEY,
5
});
6
7
const { result: jwks } = await gwop.auth.getJwks();
8
console.log(jwks.keys[0].kid); // "gwop-auth-v1"

1
import * as jose from "jose";
2
3
async function fetchGwopJwks() {
4
  const { result } = await gwop.auth.getJwks();
5
  return result;
6
}
7
8
// Fetch JWKS once at startup
9
let cachedJwks = await fetchGwopJwks();
10
let jwks = jose.createLocalJWKSet({ keys: cachedJwks.keys });
11
12
// Verify on each request
13
async function verifyGwopJwt(token: string) {
14
  try {
15
    const { payload } = await jose.jwtVerify(token, jwks, {
16
      issuer: "https://identity.gwop.io",
17
      algorithms: ["RS256"],
18
    });
19
20
    return {
21
      sub: payload.sub,        // "base:0x742d..." or "solana:7sSi..."
22
      merchantId: payload.mid, // Your merchant ID
23
      sessionId: payload.sid,  // Session identifier
24
    };
25
  } catch (error) {
26
    if (error instanceof jose.errors.JWKSNoMatchingKey) {
27
      cachedJwks = await fetchGwopJwks();
28
      jwks = jose.createLocalJWKSet({ keys: cachedJwks.keys });
29
30
      const { payload } = await jose.jwtVerify(token, jwks, {
31
        issuer: "https://identity.gwop.io",
32
        algorithms: ["RS256"],
33
      });
34
35
      return {
36
        sub: payload.sub,
37
        merchantId: payload.mid,
38
        sessionId: payload.sid,
39
      };
40
    }
41
42
    throw error;
43
  }
44
}

1
// Cache JWKS on startup
2
let cachedJwks = await fetchGwopJwks();
3
let verifier = jose.createLocalJWKSet({ keys: cachedJwks.keys });
4
5
// Refresh on kid mismatch (key rotation)
6
async function getVerifier(token: string) {
7
  const tokenHeader = jose.decodeProtectedHeader(token);
8
  const hasKey = cachedJwks.keys.some((k) => k.kid === tokenHeader.kid);
9
10
  if (!hasKey) {
11
    cachedJwks = await fetchGwopJwks();
12
    verifier = jose.createLocalJWKSet({ keys: cachedJwks.keys });
13
  }
14
15
  return verifier;
16
}