IO Wallet SDK
    Preparing search index...

    Function verifyAuthorizationRequest

    • Verifies an authorization request by validating DPoP and client attestation credentials.

      This function performs cryptographic verification of DPoP proofs and client attestation JWTs extracted from authorization request headers. It validates signatures, checks expiration times, and optionally ensures that DPoP and client attestation use the same key.

      Important: This function performs verification only. Use parseAuthorizationRequest first to extract the necessary JWTs from request headers.

      Parameters

      Returns Promise<VerifyAuthorizationRequestResult>

      A promise resolving to verification results containing:

      • dpop - Verified DPoP information including JWK and thumbprint (if DPoP was provided)
      • clientAttestation - Verified client attestation JWTs (if client attestation was provided)

      When DPoP is required but missing

      When client attestation is required but missing

      When client_id doesn't match between request and client attestation

      When DPoP and client attestation keys don't match (if ensureConfirmationKeyMatchesDpopKey is true)

      When JWT signature verification fails

      When JWT is expired or has invalid claims

      const result = await verifyAuthorizationRequest({
        authorizationRequest: { client_id: 'client-123' },
        authorizationServerMetadata: { issuer: 'https://auth.example.com' },
        callbacks: { hash: hashCallback, verifyJwt: verifyJwtCallback },
        dpop: {
          jwt: dpopJwtFromHeaders,
          required: true,
          allowedSigningAlgs: ['ES256']
        },
        clientAttestation: {
          walletAttestationJwt: clientAttJwtFromHeaders,
          clientAttestationPopJwt: clientAttPopJwtFromHeaders,
          required: true,
          ensureConfirmationKeyMatchesDpopKey: true
        },
        request: httpRequest
      });

      console.log(result.dpop?.jwkThumbprint);
      console.log(result.clientAttestation?.clientAttestation.payload.sub);

    Settings

    Member Visibility