Token validation#

On this page

Signed JWTs⁠ (opens in a new tab) (JWS) are crucial to the OpenID Connect specification in order to ensure the authenticity and integrity of data exchanged between parties.

When integrating BankID over OpenID Connect you must always validate Tokens that are issued.

Validation of Signed Tokens#

Following well established OpenID Connect standards, BankID will sign⁠ (opens in a new tab) all Tokens issued:

ID Tokens
Access Tokens
Refresh Tokens
Userinfo

You must validate JWT signatures and ensure that the signing key certificate was issued by the officially published root certificates⁠ (opens in a new tab).

Keys used for signing are marked with

{
  "use": "sig"
}

Steps to validate tokens#

The steps required to securely validate a JWS Token are found here.