verifyTappifyToken

function verifyTappifyToken(token, options): Promise<TappifyClaims>;

Verifies an install token against Tappify’s signing keys and returns its claims.

Parameters

token

string

options

VerifyTokenOptions

Returns

Promise<TappifyClaims>

Remarks

Checks the RS256 signature, the expiry with 60 seconds of clock tolerance, and that the audience is ext:<extensionId>. Rejects with a TapError carrying TAP_TOKEN_INVALID when the signature, the expiry or a required claim is wrong, and TAP_TOKEN_AUDIENCE when the token was issued for another extension. A remote key set is fetched once per url and cached for the process, so calling this per request costs nothing after the first. createTappifyHandler already verifies every route but health, so call this only outside the handler, or where you accept a Tappify token on a route of your own.

Example

import { verifyTappifyToken } from '@tappify/extension-sdk/server';

async function whoCalled(request: Request): Promise<string> {
  const token = (request.headers.get('authorization') ?? '').replace('Bearer ', '');
  const claims = await verifyTappifyToken(token, { extensionId: 'starter' });
  return claims.installId;
}

Start

Build

Test

Publish

Reference

Parameters

token

options

Returns

Remarks

Example

​Parameters

​token

​options

​Returns

​Remarks

​Example

Parameters

token

options

Returns

Remarks

Example