JWKS

1
import { Gwop } from "@gwop/sdk";
2
3
const gwop = new Gwop({
4
  merchantApiKey: process.env.GWOP_MERCHANT_API_KEY,
5
});
6
7
const { result: jwks } = await gwop.auth.getJwks();
8
console.log(jwks.keys[0].kid); // "gwop-auth-v1"

1
import * as jose from "jose";
2
3
// Fetch JWKS once at startup
4
const { result: jwksResponse } = await gwop.auth.getJwks();
5
const jwks = jose.createLocalJWKSet({ keys: jwksResponse.keys });
6
7
// Verify on each request
8
async function verifyGwopJwt(token: string) {
9
  const { payload } = await jose.jwtVerify(token, jwks, {
10
    issuer: "https://identity.gwop.io",
11
    algorithms: ["RS256"],
12
  });
13
14
  return {
15
    sub: payload.sub,           // "base:0x742d..." or "solana:7sSi..."
16
    merchantId: payload.mid,    // Your merchant ID
17
    sessionId: payload.sid,     // Session identifier
18
  };
19
}

1
// Cache JWKS on startup
2
let cachedJwks = await fetchJwks();
3
4
// Refresh on kid mismatch (key rotation)
5
async function getJwks() {
6
  const tokenHeader = jose.decodeProtectedHeader(token);
7
  const hasKey = cachedJwks.keys.some((k) => k.kid === tokenHeader.kid);
8
  if (!hasKey) {
9
    cachedJwks = await fetchJwks(); // key rotated
10
  }
11
  return cachedJwks;
12
}