Required Fields
Excerpt | ||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Please note that each Claim key is case sensitive.
JWT Payload ExampleBelow is an example of the JSON content of a basic response JWT Payload where we are passing an object within the Payload claim:
Below is an example of the JSON content of a basic response JWT Payload where we are passing a string within the Payload claim. This would occur when the request JWT included a
|
Code Samples
Below are a code samples of how you can verify a JWT in a few languages
Warning |
---|
We do not recommend using these samples unmodified in a production environment. They are intended as examples only. |
Validating a Response JWT in .NET
We recommend using an existing third party library to assist you in generating and validating JWTs. Some of our recommendations are:
JSON Web Token Handler - www.nuget.org
The JWT.io website contains a list of additional approved libraries, with their feature sets. Check it out here.
Code Block | ||||
---|---|---|---|---|
| ||||
public string DecodeAndValidateResponseJwt(string responseJwt) { string jsonPayload = string.Empty; try { var apiKey = ConfigurationManager.AppSettings["APIKey"]; jsonPayload = JWT.JsonWebToken.Decode(responseJwt, apiKey); Console.WriteLine(jsonPayload); } catch (JWT.SignatureVerificationException) { Console.WriteLine("Signature validation failed! JWT is not valid!"); } return jsonPayload; } |
Validating a Response JWT in Java
We recommend using an existing third party library to assist you in generating and validating JWTs. The JWT.io website contains a list of approved libraries, with their feature sets. Check it out here.
Code Block | ||
---|---|---|
| ||
// The jwt argument is the Cardinal response jwt handed back to the payments.validated event. // This value is NOT the request jwt generated by the merchant and sent to Cardinal. public static boolean validateJwt(String jwt) { try{ // The API Key used here to validate the Cardinal response is the same // API Key you use to generate your request jwt. Claims claims = (Claims) Jwts.parser() .setSigningKey(apiKey.getBytes()) .parse(jwt) .getBody(); System.out.println("Signature Verified"); return true; } catch(SignatureException se) { System.out.println("Signature Validation Failed! JWT is not valid."); } catch(Exception ex){ System.out.println("General Error: " + ex.getMessage()); } return false; } |
Validating a Response JWT in PHP
We recommend using an existing third party library to assist you in generating and validating JWTs. The JWT.io website contains a list of approved libraries, with their feature sets. Check it out here.
Code Block | ||
---|---|---|
| ||
<?php
/*
composer.json Example:
{
"require": {
"firebase/php-jwt": "^4.0"
}
}
*/
require "vendor/autoload.php"; // Autoload.php generated by Composer
use Firebase\JWT\JWT;
$GLOBALS['ApiKey'] = '[INSERT_API_KEY_HERE]';
$GLOBALS['ApiId'] = '[INSERT_API_KEY_ID_HERE]';
$GLOBALS['OrgUnitId'] = '[INSERT_ORG_UNIT_ID_HERE]';
function validateJwt($jwt) {
// This will validate JWT Requests or Responses from Cardinal.
try{
// Validate the JWT by virtue of successful decoding
$decoded = JWT::decode($jwt, $GLOBALS['ApiKey'], array('HS256'));
// Cardinal JWT Request & Responses should always contain the Merchants OrgUnitId
return strcmp($decoded->OrgUnitId, $GLOBALS['OrgUnitId']) == 0;
} catch (Exception $e) {
echo "Exception in validateJwt: ", $e->getMessage(), "\n";
}
return false;
}
?> |