Documentation

curl https://api.yourdomain.com/data \
  -H "Authorization: Bearer eyJhbGci..."

import jwt
from jwt import PyJWKClient

# Instantiate once at startup — PyJWKClient caches the key set
jwks_client = PyJWKClient(
    'https://auth.authknox.com/.well-known/jwks.json'
)

# Verify on every inbound request
signing_key = jwks_client.get_signing_key_from_jwt(token)
payload = jwt.decode(
    token,
    signing_key.key,
    algorithms=['RS256'],
    audience='https://api.yourdomain.com',
    issuer='https://auth.authknox.com',
    # exp validated automatically
)
# payload['sub'] == client_id of the caller

import (
    "fmt"
    "github.com/golang-jwt/jwt/v5"
    "github.com/lestrrat-go/jwx/v2/jwk"
)

// Fetch JWKS once at startup (use jwk.NewCache for auto-refresh in production)
keySet, _ := jwk.Fetch(ctx,
    "https://auth.authknox.com/.well-known/jwks.json",
)

// Verify on every inbound request
token, err := jwt.Parse(tokenString,
    func(t *jwt.Token) (interface{}, error) {
        // Reject non-RSA algorithms — prevents algorithm confusion attacks (RFC 8725)
        if _, ok := t.Method.(*jwt.SigningMethodRSA); !ok {
            return nil, fmt.Errorf("unexpected signing method: %v", t.Header["alg"])
        }
        kid, _ := t.Header["kid"].(string)
        key, found := keySet.LookupKeyID(kid)
        if !found {
            return nil, fmt.Errorf("unknown key id: %s", kid)
        }
        var pub interface{}
        if err := key.Raw(&pub); err != nil {
            return nil, err
        }
        return pub, nil
    },
    jwt.WithIssuer("https://auth.authknox.com"),
    jwt.WithAudience("https://api.yourdomain.com"),
    jwt.WithExpirationRequired(),
)
// token.Claims.(jwt.MapClaims)["sub"] == client_id of the caller