# What are JWT's signed with? **URL:** \ **Category:** Extensions\ **Created:** [April 24, 2018, 10:19am UTC](https://staging-discuss.dev.twitch.com/t/what-are-jwts-signed-with/15461 "2018-04-24T10:19:42Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![nitro\_marky](https://d1d6mrmdu7ztse.cloudfront.net/user_avatar/staging-discuss.dev.twitch.com/nitro_marky/32/3577_2.png) [@nitro\_marky](https://staging-discuss.dev.twitch.com/u/nitro_marky)\ **Post date:** [April 24, 2018, 10:19am UTC](https://staging-discuss.dev.twitch.com/t/what-are-jwts-signed-with/15461/1 "2018-04-24T10:19:42Z")
I assumed that JWT’s taken from onAuthorised were signed with the extension secret key but every time I try to verify with that key it comes back as a failure. Does anyone know what the actual signing token is? Thanks, Mark ---
**Author:** ![Hellcat](https://d1d6mrmdu7ztse.cloudfront.net/user_avatar/staging-discuss.dev.twitch.com/hellcat/32/3621_2.png) [@Hellcat](https://staging-discuss.dev.twitch.com/u/Hellcat)\ **Post date:** [April 24, 2018, 10:44am UTC](https://staging-discuss.dev.twitch.com/t/what-are-jwts-signed-with/15461/2 "2018-04-24T10:44:01Z")
Yes, the JWT is signed with the secret key of your extension. Depending on what library you’re using or how you’ve implemented the signature verification, you might need to base64-decode the key prior to using it to verify the JWT. You also need to use the correct hash algorithm for the verification. Maybe it helps, here’s where my code does the actual verification of the JWT (PHP based EBS): [https://git.dev.hellcat.net/users/hellcat/repos/ttvext-bbswall/browse/src/AppBundle/Services/JwtHandler.php#54](https://git.dev.hellcat.net/users/hellcat/repos/ttvext-bbswall/browse/src/AppBundle/Services/JwtHandler.php#54) ---
**Author:** ![nitro\_marky](https://d1d6mrmdu7ztse.cloudfront.net/user_avatar/staging-discuss.dev.twitch.com/nitro_marky/32/3577_2.png) [@nitro\_marky](https://staging-discuss.dev.twitch.com/u/nitro_marky)\ **Post date:** [April 24, 2018, 10:46am UTC](https://staging-discuss.dev.twitch.com/t/what-are-jwts-signed-with/15461/3 "2018-04-24T10:46:45Z")
Thanks, I’ll give decoding a go. Mark ---
**Author:** ![FRANXX](https://avatars.discourse-cdn.com/v4/letter/f/0ea827/32.png) [@FRANXX](https://staging-discuss.dev.twitch.com/u/FRANXX)\ **Post date:** [April 24, 2018, 9:39pm UTC](https://staging-discuss.dev.twitch.com/t/what-are-jwts-signed-with/15461/4 "2018-04-24T21:39:19Z")
What I noticed is that JWT token verification works if it the token comes from the production environment, but the token validation will fail if it is obtained from the developer rig (still waiting for a dev to confirm this bug). ---
**Author:** ![nitro\_marky](https://d1d6mrmdu7ztse.cloudfront.net/user_avatar/staging-discuss.dev.twitch.com/nitro_marky/32/3577_2.png) [@nitro\_marky](https://staging-discuss.dev.twitch.com/u/nitro_marky)\ **Post date:** [April 26, 2018, 12:07pm UTC](https://staging-discuss.dev.twitch.com/t/what-are-jwts-signed-with/15461/5 "2018-04-26T12:07:35Z")
I would be inclined to agree, I’m still on the rig and have not been able to validate once yet. ---
**Author:** ![Hellcat](https://d1d6mrmdu7ztse.cloudfront.net/user_avatar/staging-discuss.dev.twitch.com/hellcat/32/3621_2.png) [@Hellcat](https://staging-discuss.dev.twitch.com/u/Hellcat)\ **Post date:** [April 26, 2018, 12:11pm UTC](https://staging-discuss.dev.twitch.com/t/what-are-jwts-signed-with/15461/6 "2018-04-26T12:11:57Z")
Did you put the extension secret (key) into the dev-rig config? ---
**Author:** ![nitro\_marky](https://d1d6mrmdu7ztse.cloudfront.net/user_avatar/staging-discuss.dev.twitch.com/nitro_marky/32/3577_2.png) [@nitro\_marky](https://staging-discuss.dev.twitch.com/u/nitro_marky)\ **Post date:** [April 26, 2018, 12:12pm UTC](https://staging-discuss.dev.twitch.com/t/what-are-jwts-signed-with/15461/7 "2018-04-26T12:12:47Z")
Yeah, I’ve put all the relevant data in. ---
**Author:** ![FRANXX](https://avatars.discourse-cdn.com/v4/letter/f/0ea827/32.png) [@FRANXX](https://staging-discuss.dev.twitch.com/u/FRANXX)\ **Post date:** [April 26, 2018, 6:28pm UTC](https://staging-discuss.dev.twitch.com/t/what-are-jwts-signed-with/15461/8 "2018-04-26T18:28:38Z")
I tested it with the same piece of validation code over the same secret. The validation works on production and doesn’t work on developer rig. If anybody is able to validate the token that is returned by the developer rig please do post here. ---
**Author:** ![davethecust](https://d1d6mrmdu7ztse.cloudfront.net/user_avatar/staging-discuss.dev.twitch.com/davethecust/32/3867_2.png) [@davethecust](https://staging-discuss.dev.twitch.com/u/davethecust)\ **Post date:** [April 30, 2018, 6:58pm UTC](https://staging-discuss.dev.twitch.com/t/what-are-jwts-signed-with/15461/9 "2018-04-30T18:58:35Z")
How are you trying to validate the jwt? As far as i can tell there is no rig bug. The payload is signed with the secret and I am able to verify the signature on [jwt.io](http://jwt.io) consistently. I think a possible gotcha here is that the secret given from the dev site is base64 encoded, so on [jwt.io](http://jwt.io) (or with whatever library you are using) you must make sure you check the button `secret base64 encoded`. Additionally, I’ve used the jwt created from the rig to send messages to and from clients over Twitch Pubsub. As a general suggestion, when troubleshooting the rig, ensure you’ve pulled down the latest changes, clear local storage, and recreate the views. ---
**Author:** ![trevorhinesley](https://d1d6mrmdu7ztse.cloudfront.net/user_avatar/staging-discuss.dev.twitch.com/trevorhinesley/32/4785_2.png) [@trevorhinesley](https://staging-discuss.dev.twitch.com/u/trevorhinesley)\ **Post date:** [August 5, 2018, 10:59pm UTC](https://staging-discuss.dev.twitch.com/t/what-are-jwts-signed-with/15461/10 "2018-08-05T22:59:52Z")
Are you sure that’s working? If I try the JWT decoder on [jwt.io](http://jwt.io), even with that checked, it fails. It _looks_ like it passes only if you paste the token in then click in a different box, because the right side updates the token on the left to be valid. But on first paste, it’s invalid. ---
**Author:** ![CalldiDoctor](https://avatars.discourse-cdn.com/v4/letter/c/8e7dd6/32.png) [@CalldiDoctor](https://staging-discuss.dev.twitch.com/u/CalldiDoctor)\ **Post date:** [August 7, 2018, 9:57pm UTC](https://staging-discuss.dev.twitch.com/t/what-are-jwts-signed-with/15461/11 "2018-08-07T21:57:08Z")
I have found the same behavior for the Viewers JWT generated by the local developer-rig. I’m not able to validate them. However, I’m able to successfully validate the tokens generated for the broadcaster in the “live config” page. I’m validating this with the secret that I set up. Is it possible that some tokens are generated using some default/hardcoded password? I’ll try to find it out checking the developer’s rig code. EDIT: I have just seen that the token given to a “Logged-In Viewer” is signed with the default developer-rig secret. Am I missing to add my custom password somewhere? ---
**Author:** ![trevorhinesley](https://d1d6mrmdu7ztse.cloudfront.net/user_avatar/staging-discuss.dev.twitch.com/trevorhinesley/32/4785_2.png) [@trevorhinesley](https://staging-discuss.dev.twitch.com/u/trevorhinesley)\ **Post date:** [August 7, 2018, 10:11pm UTC](https://staging-discuss.dev.twitch.com/t/what-are-jwts-signed-with/15461/12 "2018-08-07T22:11:48Z")
I believe you’re correct, broadcoaster tokens work for me, but not viewer. ---
**Author:** ![BarryCarlyon](https://d1d6mrmdu7ztse.cloudfront.net/user_avatar/staging-discuss.dev.twitch.com/barrycarlyon/32/253_2.png) [@BarryCarlyon](https://staging-discuss.dev.twitch.com/u/BarryCarlyon)\ **Post date:** [August 7, 2018, 10:16pm UTC](https://staging-discuss.dev.twitch.com/t/what-are-jwts-signed-with/15461/13 "2018-08-07T22:16:32Z")
It should: If in local mode it’ll use the devRig secret. If in live mode it’ll use your actual values ---
**Author:** ![CalldiDoctor](https://avatars.discourse-cdn.com/v4/letter/c/8e7dd6/32.png) [@CalldiDoctor](https://staging-discuss.dev.twitch.com/u/CalldiDoctor)\ **Post date:** [August 7, 2018, 10:20pm UTC](https://staging-discuss.dev.twitch.com/t/what-are-jwts-signed-with/15461/14 "2018-08-07T22:20:55Z")
Actually I’ve just found [this](https://github.com/twitchdev/developer-rig#providing-a-secret-for-your-ebs-in-local-mode) in the documentation. However, the start script allows you to pass the secret as the parameter -s. This parameter is actually being taken into account when generating the token for the broadcaster. I don’t get why it is not being used for generating viewers tokens. ---
**Author:** ![BarryCarlyon](https://d1d6mrmdu7ztse.cloudfront.net/user_avatar/staging-discuss.dev.twitch.com/barrycarlyon/32/253_2.png) [@BarryCarlyon](https://staging-discuss.dev.twitch.com/u/BarryCarlyon)\ **Post date:** [August 7, 2018, 10:22pm UTC](https://staging-discuss.dev.twitch.com/t/what-are-jwts-signed-with/15461/15 "2018-08-07T22:22:20Z")
> [@CalldiDoctor](#): > > Actually I’ve just found [this](https://github.com/twitchdev/developer-rig#providing-a-secret-for-your-ebs-in-local-mode) in the documentation. Which is for local mode. > [@CalldiDoctor](#): > > However, the start script allows you to pass the secret as the parameter -s Which is for live mode. > [@CalldiDoctor](#): > > This parameter is actually being taken into account when generating the token for the broadcaster. So in local mode it’s using the passed secret instead of the overridden rig secret for broadcaster tokens? Starting in Local mode, should ignore a passed secret really… ---
**Author:** ![CalldiDoctor](https://avatars.discourse-cdn.com/v4/letter/c/8e7dd6/32.png) [@CalldiDoctor](https://staging-discuss.dev.twitch.com/u/CalldiDoctor)\ **Post date:** [August 7, 2018, 10:24pm UTC](https://staging-discuss.dev.twitch.com/t/what-are-jwts-signed-with/15461/16 "2018-08-07T22:24:41Z")
> [@BarryCarlyon](#): > > So in local mode it’s using the passed secret instead of the overridden rig secret for broadcaster tokens? Yes, the secret used for generating broadcaster tokens in local mode is the one passed as -s parameter. I’m using the following command to start up the developer rig in local mode: `yarn start -s bXlfc3VwZXJfUzNLcmVULVNVNEpKSg== -l ../panel.json` ---
**Author:** ![BarryCarlyon](https://d1d6mrmdu7ztse.cloudfront.net/user_avatar/staging-discuss.dev.twitch.com/barrycarlyon/32/253_2.png) [@BarryCarlyon](https://staging-discuss.dev.twitch.com/u/BarryCarlyon)\ **Post date:** [August 7, 2018, 10:25pm UTC](https://staging-discuss.dev.twitch.com/t/what-are-jwts-signed-with/15461/17 "2018-08-07T22:25:17Z")
Just do `yarn start -l ../panel.json` For local mode. You found a bug in the rig ---
**Author:** ![CalldiDoctor](https://avatars.discourse-cdn.com/v4/letter/c/8e7dd6/32.png) [@CalldiDoctor](https://staging-discuss.dev.twitch.com/u/CalldiDoctor)\ **Post date:** [August 7, 2018, 10:27pm UTC](https://staging-discuss.dev.twitch.com/t/what-are-jwts-signed-with/15461/18 "2018-08-07T22:27:31Z")
Okay, so the expected behavior for local mode is to ignore the passed secret. Would be useful if I open a PR in order to ignore the parameter? ---
**Author:** ![BarryCarlyon](https://d1d6mrmdu7ztse.cloudfront.net/user_avatar/staging-discuss.dev.twitch.com/barrycarlyon/32/253_2.png) [@BarryCarlyon](https://staging-discuss.dev.twitch.com/u/BarryCarlyon)\ **Post date:** [August 7, 2018, 10:28pm UTC](https://staging-discuss.dev.twitch.com/t/what-are-jwts-signed-with/15461/19 "2018-08-07T22:28:44Z")
I’m not sure if the rigs intention is to use the passed secret or ignore the passed secret in localmode. ---
**Author:** ![CalldiDoctor](https://avatars.discourse-cdn.com/v4/letter/c/8e7dd6/32.png) [@CalldiDoctor](https://staging-discuss.dev.twitch.com/u/CalldiDoctor)\ **Post date:** [August 7, 2018, 10:29pm UTC](https://staging-discuss.dev.twitch.com/t/what-are-jwts-signed-with/15461/20 "2018-08-07T22:29:19Z")
Okay, so I’ll just run it without the parameter and everything should work fine 🙂 [Next page](https://staging-discuss.dev.twitch.com/t/what-are-jwts-signed-with/15461.md?page=2)