Required Fields
Excerpt | ||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Please note that each Claim key is case sensitive.
JWT Payload ExampleBelow is an example of the JSON content of a basic response JWT Payload where we are passing an object within the Payload claim:
Below is an example of the JSON content of a basic response JWT Payload where we are passing a string within the Payload claim. This would occur when the request JWT included a
|
Code Samples
Below are a code samples of how you can verify a JWT in a few languages
Warning |
---|
We do not recommend using these samples unmodified in a production environment. They are intended as examples only. |
Validating a Response JWT in .NET
We recommend using an existing third party library to assist you in generating and validating JWTs. Some of our recommendations are:
JSON Web Token Handler - www.nuget.org
The JWT.io website contains a list of additional approved libraries, with their feature sets. Check it out here.
Code Block | ||||
---|---|---|---|---|
| ||||
public string DecodeAndValidateResponseJwt(string responseJwt) { string jsonPayload = string.Empty; try { var apiKey = ConfigurationManager.AppSettings["APIKey"]; jsonPayload = JWT.JsonWebToken.Decode(responseJwt, apiKey); Console.WriteLine(jsonPayload); } catch (JWT.SignatureVerificationException) { Console.WriteLine("Signature validation failed! JWT is not valid!"); } return jsonPayload; } |
Validating a Response JWT in Java
We recommend using an existing third party library to assist you in generating and validating JWTs. The JWT.io website contains a list of approved libraries, with their feature sets. Check it out here.
Code Block | ||
---|---|---|
| ||
// The jwt argument is the Cardinal response jwt handed back to the payments.validated event. // This value is NOT the request jwt generated by the merchant and sent to Cardinal. public static boolean validateJwt(String jwt) { try{ // The API Key used here to validate the Cardinal response is the same // API Key you use to generate your request jwt. Claims claims = (Claims) Jwts.parser() .setSigningKey(apiKey.getBytes()) .parse(jwt) .getBody(); System.out.println("Signature Verified"); return true; } catch(SignatureException se) { System.out.println("Signature Validation Failed! JWT is not valid."); } catch(Exception ex){ System.out.println("General Error: " + ex.getMessage()); } return false; } |
Validating a Response JWT in PHP
We recommend using an existing third party library to assist you in generating and validating JWTs. The JWT.io website contains a list of approved libraries, with their feature sets. Check it out here.
Code Block | ||
---|---|---|
| ||
<?php /* composer.json Example: { "require": { "firebase/php-jwt": "^4.0" } } */ require "vendor/autoload.php"; // Autoload.php generated by Composer use Firebase\JWT\JWT; $GLOBALS['ApiKey'] = '[INSERT_API_KEY_HERE]'; $GLOBALS['ApiId'] = '[INSERT_API_KEY_ID_HERE]'; $GLOBALS['OrgUnitId'] = '[INSERT_ORG_UNIT_ID_HERE]'; function validateJwt($jwt) { // This will validate JWT Requests or Responses from Cardinal. try{ // Validate the JWT by virtue of successful decoding $decoded = JWT::decode($jwt, $GLOBALS['ApiKey'], array('HS256')); // Cardinal JWT Request & Responses should always contain the Merchants OrgUnitId return strcmp($decoded->OrgUnitId, $GLOBALS['OrgUnitId']) == 0; } catch (Exception $e) { echo "Exception in validateJwt: ", $e->getMessage(), "\n"; } return false; } ?> |