Verify Signatures

We send a JWT with each request. This JWT is signed by your individual secret signing keys and sent in the Upstash-Signature HTTP header.

To verify the jwt you can choose from a wide array of open source libraries, or roll your own solution.

​

Claims

All claims in the JWT are listed here

​

Verifying

The exact implementation depends on the language of your choice and the library if you use one.

Instead here are the steps you need to follow:

1. Split the JWT into its header, payload and signature
2. Verify the signature
3. Decode the payload and verify the claims
   • iss: The issuer must beUpstash.
   • sub: The subject must the url of your API.
   • exp: Verify the token has not expired yet.
   • nbf: Verify the token is already valid.
   • body: Hash the raw request body using SHA-256 and compare it with the body claim.

You can also reference the implementation in our typescript sdk or use the methods provided in the SDKs:

After you have verified the signature and the claims, you can be sure the request came from Upstash and process it accordingly.