# Token validation

Signed [JWTs](https://datatracker.ietf.org/doc/html/rfc7519) (JWS) are crucial to the OpenID Connect specification in order
to ensure the authenticity and integrity of data exchanged between parties.

When integrating BankID over OpenID Connect you **must always** validate Tokens that are issued.

## Validation of Signed Tokens

Following well established OpenID Connect standards, BankID will [sign](https://openid.net/specs/openid-connect-core-1_0.html#SigEnc) all Tokens issued:

- [ID Tokens](https://docs.stoe.no/bankid-oidc-provider/core-concepts/id-token.md)
- [Access Tokens](https://docs.stoe.no/bankid-oidc-provider/core-concepts/access-tokens.md)
- [Refresh Tokens](https://docs.stoe.no/bankid-oidc-provider/core-concepts/refresh-tokens.md)
- [Userinfo](https://docs.stoe.no/bankid-oidc-provider/api/userinfo.md)

You **must** validate JWT signatures and ensure that the signing key certificate was issued by the officially published
[root certificates](https://bankid.no/bedrift/utvikler/bankid-oidc-certificates).

> **Important**
>
> - ensure that tokens are **not** tampered with after being issued by the OIDC Provider from BankID.
> - guarantee that the **origin** of the Tokens are in fact BankID, and not a potential "man-in-the-middle" actor.

Keys used for signing are marked with

```json
{
  "use": "sig"
}
```

### Steps to validate tokens

The steps required to securely validate a JWS Token are found [here](https://docs.stoe.no/bankid-oidc-provider/advanced-topics/verify-token.md).