Validate Auth0 JWT Tokens using JWKS or Signing Cert

Created by

Jimleuk

Last update

Last update 2 months ago

Try It Out

Auth0 doesn't work with the standard JWT auth option because:

Auth0 tokens use the RS256 algorithm.
RS256 JWT credentials in n8n require the user to use private and public keys and not secret phrase.
Auth0 does not give you access to your Auth0 instance private keys.

The solution is to handle JWT validation after the webhook is received using the code node.

There are 2 approaches to validate Auth0 tokens: using your application's JWKS file or using your signing cert.
Both solutions uses the code node to access nodeJS libraries to verify the token.
JWKS: the JWK-RSA library is used to validate the application's JWKS URI hosted on Auth0
Signing Cert: the application's signing cert is imported into the workflow and used to verify token.
In both cases, when the token is found to be invalid, an error is thrown. However, as we can use error outputs for the code node, the error does not stop the workflow and instead is redirected to a 401 unauthorized webhook response.
When token is validated, the webhook response is forwarded on the success branch and the token decoded payload is attached.