Verify Signatures

We send a JWT with each request. This JWT is signed by your individual secret signing keys and sent in the Upstash-Signature HTTP header.

To verify the jwt you can choose from a wide array of open source libraries, or roll your own solution.

​

Claims

All claims in the JWT are listed here

​

Verifying

The exact implementation depends on the language of your choice and the library if you use one.

Instead here are the steps you need to follow:

1. Split the JWT into its header, payload and signature
2. Verify the signature
3. Decode the payload and verify the claims
   • iss: The issuer must beUpstash.
   • sub: The subject must the url of your API.
   • exp: Verify the token has not expired yet.
   • nbf: Verify the token is already valid.
   • body: Hash the raw request body using SHA-256 and compare it with the body claim.

You can also reference the implementation in our typescript sdk or use the methods provided in the SDKs:

import { Receiver } from "@upstash/qstash";

const receiver = new Receiver({
  currentSigningKey: "YOUR_CURRENT_SIGNING_KEY",
  nextSigningKey: "YOUR_NEXT_SIGNING_KEY",
});

// ... in your request handler

const signature = req.headers["Upstash-Signature"];
const body = req.body;

const isValid = receiver.verify({
  body,
  signature,
  url: "YOUR-SITE-URL",
});

After you have verified the signature and the claims, you can be sure the request came from Upstash and process it accordingly.