We send a JWT with each request. This JWT is signed by your individual secret
signing keys and sent in the
Upstash-Signature HTTP header.
To verify the jwt you can choose from a wide array of open source libraries, or roll your own solution.
All claims in the JWT are listed here
The exact implementation depends on the language of your choice and the library if you use one.
Instead here are the steps you need to follow:
- Split the JWT into its header, payload and signature
- Verify the signature
- Decode the payload and verify the claims
iss: The issuer must be
sub: The subject must the url of your API.
exp: Verify the token has not expired yet.
nbf: Verify the token is already valid.
body: Hash the raw request body using
SHA-256and compare it with the
You can also reference the implementation in our typescript sdk.
After you have verified the signature and the claims, you can be sure the request came from Upstash and process it accordingly.