The verifier caches JWKS public keys according to the configured cache settings. Create one verifier instance and reuse it for all verification requests.

Usage

Basic usage:

import { initUserTokenVerifier } from '@canva/app-middleware';

// Initialize once at app startup
const userTokenVerifier = initUserTokenVerifier({
  appId: process.env.CANVA_APP_ID,
});

// Verify tokens per request inside a handler
const payload = await userTokenVerifier.verify(token);
console.log(payload.userId, payload.brandId);

TYPESCRIPT

With custom options:

const userTokenVerifier = initUserTokenVerifier({
  appId: process.env.CANVA_APP_ID,
  cacheMaxAgeMinutes: 30,
  timeoutMs: 10000,
});

TYPESCRIPT

Parameters

optionsUserTokenVerifierOptions

Required

Configuration options for the verifier

appIdstring

Required

The ID of the Canva app, obtained via the developer portal canva.com/developers.

cacheMaxAgeMinutesnumber

Optional

The maximum age of the JWKS cache in minutes.

Default value: 60

timeoutMsnumber

Optional

The timeout for the JWKS fetch in milliseconds.

Default value: 30000

baseUrlstring

Optional

The base URL for the JWKS endpoint.

Default value: "https://api.canva.com"

Returns

A configured verifier instance.

verifyfunction

Verifies a Canva user JWT token and returns the decoded payload.

Parameters

tokenstring

Required

The JWT token to verify

Returns

The verified user token payload. This is a Promise that resolves with the following object:

appIdstring

The ID of the Canva app

userIdstring

The ID of the authenticated user

brandIdstring

The ID of the user's team/brand

Throws

When the token is malformed or has an invalid signature

Throws

When the token has expired