On This Page
FILTER BY TAG

Session Validation

The session JWT is digitally signed using RS256. You must confirm that it was issued by
Barclays
 and has not been tampered with. Follow these steps to validate the signature:
  1. Parse the session JWT header to extract the key ID (
    kid
    ):
    {
  "kid": "3g",
  "alg": "RS256"
}
  2. Retrieve the public key by sending a request to the
    /flex/v2/public-keys/{kid}
     endpoint:
    • Test
      : GET
      api.smartpayfuse-test.barclaycard
      flex/v2/public-keys/{kid}
    • Production
      : GET
      api.smartpayfuse.barclaycard
      flex/v2/public-keys/{kid}
  3. Use the returned RSA public key in JSON Web Key format to verify the JWT signature.
    IMPORTANT
    Depending on the cryptographic library that tou use, you may need to convert the key to Privacy-Enhanced Mail (PEM) format.
RELATED TO THIS PAGE