Quickstart

import { verifyToken } from "@joinbankroll/sdk/server";
import { BANKROLL_TOKEN_HEADER } from "@joinbankroll/sdk";

// Your app's exact origin — the token is scoped to it.
const MY_ORIGIN = "https://acme.example";

export async function requireBankrollUser(req) {
  const verified = await verifyToken(req.headers.get(BANKROLL_TOKEN_HEADER), {
    audience: MY_ORIGIN,
  });
  // null covers everything: missing header, bad signature, expired,
  // or a token minted for a different app.
  if (!verified) return null;
  return verified; // { sub, username?, geo?, identity?, ... }
}

require "jwt"
require "net/http"
require "json"

JWKS_URI = "https://joinbankroll.com/.well-known/jwks.json"
MY_ORIGIN = "https://acme.example"

# Cache the key set — don't refetch on every request.
def bankroll_jwks
  @bankroll_jwks ||= JWT::JWK::Set.new(JSON.parse(Net::HTTP.get(URI(JWKS_URI))))
end

# token = request.headers["x-bankroll-token"]
def verify_bankroll_token(token)
  payload, = JWT.decode(
    token, nil, true,
    algorithms: ["RS256"],
    iss: "https://joinbankroll.com", verify_iss: true,
    aud: MY_ORIGIN, verify_aud: true,
    jwks: bankroll_jwks
  )
  payload # { "sub" => ..., "username" => ..., ... }
end

import jwt
from jwt import PyJWKClient

JWKS_URI = "https://joinbankroll.com/.well-known/jwks.json"
MY_ORIGIN = "https://acme.example"

_jwks = PyJWKClient(JWKS_URI)

# token = request.headers["x-bankroll-token"]
def verify_bankroll_token(token: str) -> dict:
    key = _jwks.get_signing_key_from_jwt(token).key
    return jwt.decode(
        token, key,
        algorithms=["RS256"],
        issuer="https://joinbankroll.com",
        audience=MY_ORIGIN,
    )