Function decode

jose/jwt.py:66–184

Verifies a JWT string's signature and validates reserved claims. Args: token (str): A signed JWS to be verified. key (str or iterable): A key to attempt to verify the payload with. This can be simple string with an individual key (e.g. "a1234"), a tuple o

(token, key, algorithms=None, options=None, audience=None, issuer=None, subject=None, access_token=None)

def decode(token, key, algorithms=None, options=None, audience=None, issuer=None, subject=None, access_token=None):
    """Verifies a JWT string's signature and validates reserved claims.

    Args:
        token (str): A signed JWS to be verified.
        key (str or iterable): A key to attempt to verify the payload with.
            This can be simple string with an individual key (e.g. "a1234"),
            a tuple or list of keys (e.g. ("a1234...", "b3579"),
            a JSON string, (e.g. '["a1234", "b3579"]'),
            a dict with the 'keys' key that gives a tuple or list of keys (e.g {'keys': [...]} ) or
            a dict or JSON string for a JWK set as defined by RFC 7517 (e.g.
                {'keys': [{'kty': 'oct', 'k': 'YTEyMzQ'}, {'kty': 'oct', 'k':'YjM1Nzk'}]} or
                '{"keys": [{"kty":"oct","k":"YTEyMzQ"},{"kty":"oct","k":"YjM1Nzk"}]}'
            ) in which case the keys must be base64 url safe encoded (with optional padding).
        algorithms (str or list): Valid algorithms that should be used to verify the JWS.
        audience (str): The intended audience of the token.  If the "aud" claim is
            included in the claim set, then the audience must be included and must equal
            the provided claim.
        issuer (str or iterable): Acceptable value(s) for the issuer of the token.
            If the "iss" claim is included in the claim set, then the issuer must be
            given and the claim in the token must be among the acceptable values.
        subject (str): The subject of the token.  If the "sub" claim is
            included in the claim set, then the subject must be included and must equal
            the provided claim.
        access_token (str): An access token string. If the "at_hash" claim is included in the
            claim set, then the access_token must be included, and it must match
            the "at_hash" claim.
        options (dict): A dictionary of options for skipping validation steps.

            defaults = {
                'verify_signature': True,
                'verify_aud': True,
                'verify_iat': True,
                'verify_exp': True,
                'verify_nbf': True,
                'verify_iss': True,
                'verify_sub': True,
                'verify_jti': True,
                'verify_at_hash': True,
                'require_aud': False,
                'require_iat': False,
                'require_exp': False,
                'require_nbf': False,
                'require_iss': False,
                'require_sub': False,
                'require_jti': False,
                'require_at_hash': False,
                'leeway': 0,
            }

    Returns:
        dict: The dict representation of the claims set, assuming the signature is valid
            and all requested data validation passes.

    Raises:
        JWTError: If the signature is invalid in any way.
        ExpiredSignatureError: If the signature has expired.
        JWTClaimsError: If any claim is invalid in any way.