@@ -5,18 +5,30 @@ description: "Bring your own custom JWT Provider | Documentation - Web3Auth"
55image : " images/docs-meta-cards/documentation-card.png"
66---
77
8- You can incorporate your login providers by utilizing one of the custom login schemes, including RSA or ECDSA signatures. By doing so, your users can
9- continue using your current login providers or your custom authentication scheme.
8+ You can incorporate your login providers by utilizing one of the custom login schemes, including RSA
9+ or ECDSA signatures. By doing so, your users can continue using your current login providers or your
10+ custom authentication scheme.
11+
12+ :::note Minimum Growth plan required
13+
14+ Access to Custom Authentication with your own custom JWT Provider is gated. The minimum
15+ [ pricing plan] ( https://web3auth.io/pricing.html ) to create custom
16+ [ verifiers] ( /auth-provider-setup/verifiers ) is the ** Growth Plan** . However, you can use this
17+ feature for projects on ` sapphire_devnet ` for free.
18+
19+ :::
1020
1121:::info
1222
13- Custom JWT authentication is only supported with [ ` Web3Auth Plug and Play No Modal SDK ` ] ( /sdk/pnp/web/no-modal/ ) since the Web3Auth PnP Modal SDK will
14- only help you configure the social logins within the Modal UI.
23+ Custom JWT authentication is only supported with
24+ [ ` Web3Auth Plug and Play No Modal SDK ` ] ( /sdk/pnp/web/no-modal/ ) since the Web3Auth PnP Modal SDK
25+ will only help you configure the social logins within the Modal UI.
1526
1627:::
1728
18- For signing the JWT, your application must follow the JWT specification and use the private key corresponding to the JWKS. And the public keys of the
19- JWT should be exposed through an endpoint, which is used by Web3Auth to verify the JWT.
29+ For signing the JWT, your application must follow the JWT specification and use the private key
30+ corresponding to the JWKS. And the public keys of the JWT should be exposed through an endpoint,
31+ which is used by Web3Auth to verify the JWT.
2032
2133:::warning Facing issue with JWT?
2234
@@ -30,8 +42,9 @@ Check out [**this troubleshooting page to fix those.**](/troubleshooting/jwt-err
3042
3143To create a custom verifier for your JWT Providers, you'll need
3244
33- 1 . ** JWT Verifier ID** : JWT Verifier ID is the unique identifier to publicly represent a user on a verifier. e.g: ` sub ` , ` email ` , or even a custom
34- field of your JWT payload that is unique in your system for each user.
45+ 1 . ** JWT Verifier ID** : JWT Verifier ID is the unique identifier to publicly represent a user on a
46+ verifier. e.g: ` sub ` , ` email ` , or even a custom field of your JWT payload that is unique in your
47+ system for each user.
3548
36492 . ** JWK Endpoint** : An endpoint containing the JWKS used for signing the JWT.
3750
@@ -60,24 +73,26 @@ To create a custom verifier for your JWT Providers, you'll need
6073
6174 :::
6275
63- You can add up to 3 validation fields, including any claims like ` aud ` , ` sub ` , ` iss ` , ` email_verified ` etc. These are the claims against which a
64- JWT is validated.
76+ You can add up to 3 validation fields, including any claims like ` aud ` , ` sub ` , ` iss ` ,
77+ ` email_verified ` etc. These are the claims against which a JWT is validated.
6578
6679 Here are a couple of examples to be used in validation:
6780
68- - Token Audience ( ` aud ` ): The "aud" (audience) claim identifies the recipients for which the JWT is intended. Each principal intended to process
69- the JWT MUST identify itself with a value in the audience claim. If the principal processing the claim does not identify itself with a value in
70- the "aud" claim when this claim is present, then the JWT will be rejected. The ` aud ` value is a case-sensitive string containing a StringOrURI
71- value. The interpretation of audience values is generally application-specific.
81+ - Token Audience ( ` aud ` ): The "aud" (audience) claim identifies the recipients for which the
82+ JWT is intended. Each principal intended to process the JWT MUST identify itself with a value
83+ in the audience claim. If the principal processing the claim does not identify itself with a
84+ value in the "aud" claim when this claim is present, then the JWT will be rejected. The ` aud `
85+ value is a case-sensitive string containing a StringOrURI value. The interpretation of audience
86+ values is generally application-specific.
7287
73- - Token Issuer ( ` iss ` ): The issuing authority of the token. The ` iss ` value is a case-sensitive string containing a StringOrURI value. Use of
74- this claim is OPTIONAL.
88+ - Token Issuer ( ` iss ` ): The issuing authority of the token. The ` iss ` value is a case-sensitive
89+ string containing a StringOrURI value. Use of this claim is OPTIONAL.
7590
76- - Token Subject ( ` sub ` ): The subject of the token. The ` sub ` value is a case-sensitive string containing a StringOrURI value. Use of this claim
77- is OPTIONAL.
91+ - Token Subject ( ` sub ` ): The subject of the token. The ` sub ` value is a case-sensitive string
92+ containing a StringOrURI value. Use of this claim is OPTIONAL.
7893
79- - Token Email Verified ( ` email_verified ` ): The email verified claim is a boolean value that indicates whether the email address has been
80- verified.
94+ - Token Email Verified ( ` email_verified ` ): The email verified claim is a boolean value that
95+ indicates whether the email address has been verified.
8196
8297## Using ` jsonwebtoken ` to generate JWT
8398
@@ -184,7 +199,8 @@ console.log(token);
184199
185200</Tabs >
186201
187- See [ this] ( #filled-custom-jwt-verifier ) to set up the custom jwt verifier using the above JWT data on the Web3Auth Dashboard.
202+ See [ this] ( #filled-custom-jwt-verifier ) to set up the custom jwt verifier using the above JWT data
203+ on the Web3Auth Dashboard.
188204
189205### Login with JWT (idToken - jsonwebtoken)
190206
@@ -269,7 +285,8 @@ console.log(protectedHeader);
269285console .log (payload );
270286```
271287
272- See [ this] ( #filled-custom-jwt-verifier ) to set up the custom jwt verifier using the above JWT data on the Web3Auth Dashboard.
288+ See [ this] ( #filled-custom-jwt-verifier ) to set up the custom jwt verifier using the above JWT data
289+ on the Web3Auth Dashboard.
273290
274291### Login with JWT (idToken - jose)
275292
@@ -321,8 +338,9 @@ await web3auth.connectTo(WALLET_ADAPTERS.OPENLOGIN, {
321338
322339` jwks-rsa - Passport Example `
323340
324- The ` jwks-rsa ` library provides a small helper that makes it easy to configure ` passport-jwt ` with the ` RS256 ` algorithm. Using ` passportJwtSecret `
325- you can generate a secret provider that will provide the right signing key to ` passport-jwt ` based on the ` kid ` in the JWT header.
341+ The ` jwks-rsa ` library provides a small helper that makes it easy to configure ` passport-jwt ` with
342+ the ` RS256 ` algorithm. Using ` passportJwtSecret ` you can generate a secret provider that will
343+ provide the right signing key to ` passport-jwt ` based on the ` kid ` in the JWT header.
326344
327345``` tsx
328346// Step 1. npm init -y && npm install passport-jwt
@@ -359,7 +377,8 @@ passport.use(
359377app .use (passport .initialize ());
360378```
361379
362- See [ this] ( #filled-custom-jwt-verifier ) to set up the custom jwt verifier using the above JWT data on the Web3Auth Dashboard.
380+ See [ this] ( #filled-custom-jwt-verifier ) to set up the custom jwt verifier using the above JWT data
381+ on the Web3Auth Dashboard.
363382
364383### Login with JWT (idToken - passport-jwt)
365384
@@ -417,12 +436,14 @@ await web3auth.connectTo(WALLET_ADAPTERS.OPENLOGIN, {
417436
418437## What are JWKS?
419438
420- JWKS stands for JSON Web Key Set. It is a set of keys containing the public keys that should be used to verify any JSON Web Token (JWT) issued by the
421- authorization server and signed using the RS256 signing algorithm.
439+ JWKS stands for JSON Web Key Set. It is a set of keys containing the public keys that should be used
440+ to verify any JSON Web Token (JWT) issued by the authorization server and signed using the RS256
441+ signing algorithm.
422442
423443### How to create JWKS?
424444
425- - Most of the login providers that support JWT-based login will provide you this URL, such as Firebase, Google, Auth0, AWS Cognito etc.
445+ - Most of the login providers that support JWT-based login will provide you this URL, such as
446+ Firebase, Google, Auth0, AWS Cognito etc.
426447
427448 - Firebase: ` https://www.googleapis.com/service_accounts/v1/jwk/{your-project-id} `
428449 - Auth0: ` https://{your-domain}/.well-known/jwks.json `
@@ -433,7 +454,8 @@ authorization server and signed using the RS256 signing algorithm.
433454
434455### How to convert PEM to JWKS?
435456
436- If you're using ` jose ` or ` jsonwebtoken ` library, you can use the following steps to convert your PEM file to JWKS.
457+ If you're using ` jose ` or ` jsonwebtoken ` library, you can use the following steps to convert your
458+ PEM file to JWKS.
437459
4384601 . Create a Private Key using openssl.
439461
@@ -464,6 +486,8 @@ If you're using `jose` or `jsonwebtoken` library, you can use the following step
464486
465487 ![ JWKS Convert Tool] ( https://web3auth.io/community/uploads/default/optimized/2X/3/3e58a3b7378b9778b0b2d646ec2a3cf47c56ee5e_2_690x448.jpeg )
466488
467- 4 . To complete the process, you need to save the output as a ` .json ` file, host it on your server, and make sure it's publicly accessible.
489+ 4 . To complete the process, you need to save the output as a ` .json ` file, host it on your server,
490+ and make sure it's publicly accessible.
468491
469- This will give you the ` JWKS Endpoint ` , which is required when setting up a ` Custom JWT Verifier ` on the Web3Auth Dashboard.
492+ This will give you the ` JWKS Endpoint ` , which is required when setting up a ` Custom JWT Verifier `
493+ on the Web3Auth Dashboard.
0 commit comments