> ## Documentation Index
> Fetch the complete documentation index at: https://stytch.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Authenticate JWT

> Authenticate a session using a JSON Web Token (JWT)

export const jwt = "JSON Web Token: an open standard for securely transmitting information between parties as a compact and self-contained JSON object.";

Given a Session <Tooltip tip={jwt}>JWT</Tooltip>, this method authenticates a Session and updates its lifetime by the specified `session_duration_minutes`. If `session_duration_minutes` is not specified, the Session will not be extended.

<Note>
  This method is only available when using our backend SDKs.

  If you are not using one of our backend SDKs, please use the [Authenticate Session](/api-reference/consumer/api/sessions/authenticate-session) endpoint instead.
</Note>

If you provide a JWT that needs to be refreshed and is expired according to its `exp` claim, a new JWT will be returned if both the signature and the underlying Session are still valid. See our [JWT guides](/consumer-auth/manage-sessions/jwts-and-tokens) for more information.

If the JWT is older than `max_token_age_seconds` or if the JWT is expired, this method will communicate with the Stytch API to authenticate the session. Otherwise, **the JWT will be validated locally**.

## Local JWT validation

If you do not provide a `max_token_age_seconds` parameter, then the `authenticateJwt` method will only communicate with the Stytch API if the JWT is expired (Stytch JWTs have an `exp` of five minutes). Specifying a `max_token_age_seconds` parameter of less than five minutes is one way to reduce security risks inherent to local JWT validation by forcing communication with the Stytch API more frequently.

We recommend relying primarily on this method over the [`authenticateSession`](/api-reference/consumer/api/sessions/authenticate-session) method, as it handles the local JWT validation vs. remote session authentication logic for you, improving latency when the JWT is less than `max_token_age_seconds` old and authenticating the underlying session with Stytch when necessary.

### Request Parameters

<ParamField path="session_jwt" type="string" required={true}>
  The Session JWT to authenticate.
</ParamField>

<ParamField path="authorization_check" type="object" required={false}>
  If an `authorization_check` object is passed in, this endpoint will also check if the User is authorized to perform the given action on the given Resource. A User is authorized if they are assigned a Role with adequate permissions.

  If the User is not authorized to perform the specified action on the specified Resource, a 403 error will be thrown. Otherwise, the response will contain a list of Roles that satisfied the authorization check.
</ParamField>

<ParamField path="authorization_check" type="object">
  If included, this method will also check if the User is authorized to perform the given action on the given Resource. A User is authorized if they are assigned a Role with adequate permissions.

  <Expandable title="properties">
    <ParamField path="resource_id" type="string" required="true">
      A unique identifier of the RBAC Resource, provided by the developer and intended to be human-readable.

      A `resource_id` is not allowed to start with `stytch`, which is a special prefix used for Stytch default Resources with reserved `resource_id`s.
    </ParamField>

    <ParamField path="action" type="string" required="true">
      An action to take on a Resource.
    </ParamField>
  </Expandable>
</ParamField>

<ParamField path="max_token_age_seconds" type="number" required={false}>
  If set, remote verification will be forced if the JWT was issued more than that many seconds ago (based on the `iat` claim).
</ParamField>

### Response

<ResponseField name="session" type="object" required={true}>
  The [Session object](/api-reference/consumer/api/sessions/session-object) associated with the authenticated JWT.

  <Expandable title="properties">
    <ResponseField name="session_id" type="string">
      A unique identifier for a specific Session.
    </ResponseField>

    <ResponseField name="user_id" type="string">
      The unique ID of the affected User.
    </ResponseField>

    <ResponseField name="authentication_factors" type="array[objects]">
      An array of different authentication factors that comprise a Session.
    </ResponseField>

    <ResponseField name="started_at" type="string">
      The timestamp when the Session was created. Values conform to the RFC 3339 standard and are expressed in UTC, e.g. 2021-12-29T12:33:09Z.
    </ResponseField>

    <ResponseField name="last_accessed_at" type="string">
      The timestamp when the Session was last accessed. Values conform to the RFC 3339 standard and are expressed in UTC, e.g. 2021-12-29T12:33:09Z.
    </ResponseField>

    <ResponseField name="expires_at" type="string">
      The timestamp when the Session expires. Values conform to the RFC 3339 standard and are expressed in UTC, e.g. 2021-12-29T12:33:09Z.
    </ResponseField>

    <ResponseField name="attributes" type="object">
      Provided attributes help with fraud detection.

      <Expandable title="properties">
        <ResponseField name="ip_address" type="string">
          The IP address of the user.
        </ResponseField>

        <ResponseField name="user_agent" type="string">
          The user agent of the User.
        </ResponseField>
      </Expandable>
    </ResponseField>

    <ResponseField name="custom_claims" type="map">
      The custom claims map for a Session. Claims can be added to a session during a Sessions authenticate call.
    </ResponseField>

    <ResponseField name="roles" type="array[string]">
      A list of the roles associated with the session.
    </ResponseField>
  </Expandable>
</ResponseField>

<ResponseField name="session_jwt" type="string" required={true}>
  A new JWT for the authenticated Session.
</ResponseField>

<ResponseField name="session_token" type="string">
  An opaque Session token for the authenticated Session.

  Will only be returned when remote JWT authentication occurs.
</ResponseField>

<ResponseField name="user" type="object">
  The User object associated with the authenticated Session. See the [User object](/api-reference/consumer/api/users/user-object) for complete response field details.

  Will only be returned when remote JWT authentication occurs.

  <Expandable title="properties">
    <ResponseField name="created_at" type="string">
      The timestamp of the User's creation. Values conform to the RFC 3339 standard and are expressed in UTC, e.g. 2021-12-29T12:33:09Z.
    </ResponseField>

    <ResponseField name="crypto_wallets" type="array[objects]">
      An array contains a list of all crypto wallets for a given User in the Stytch API.

      <Expandable title="properties">
        <ResponseField name="crypto_wallet_id" type="string">
          The unique ID for a crypto wallet
        </ResponseField>

        <ResponseField name="crypto_wallet_address" type="string">
          The actual blockchain address of the User's crypto wallet.
        </ResponseField>

        <ResponseField name="crypto_wallet_type" type="string">
          The blockchain that the User's crypto wallet operates on, e.g. Ethereum, Solana, etc.
        </ResponseField>

        <ResponseField name="verified" type="boolean">
          If this method has been successfully authenticated by the User.
        </ResponseField>
      </Expandable>
    </ResponseField>

    <ResponseField name="emails" type="array[objects]">
      An array of email objects for the User.

      <Expandable title="properties">
        <ResponseField name="email_id" type="string">
          The unique ID of a specific email address.
        </ResponseField>

        <ResponseField name="email" type="string">
          The email address.
        </ResponseField>

        <ResponseField name="verified" type="boolean">
          If this method has been successfully authenticated by the User.
        </ResponseField>
      </Expandable>
    </ResponseField>

    <ResponseField name="name" type="object">
      The name of the User. Each field in the name object is optional.

      <Expandable title="properties">
        <ResponseField name="first_name" type="string">
          The first name of the user.
        </ResponseField>

        <ResponseField name="middle_name" type="string">
          The middle name(s) of the user.
        </ResponseField>

        <ResponseField name="last_name" type="string">
          The last name of the user.
        </ResponseField>
      </Expandable>
    </ResponseField>

    <ResponseField name="trusted_metadata" type="object">
      The trusted\_metadata field contains an arbitrary JSON object of application-specific data. See the [Metadata](/api-reference/consumer/api/resources/metadata) reference for complete field behavior details.
    </ResponseField>

    <ResponseField name="untrusted_metadata" type="object">
      The untrusted\_metadata field contains an arbitrary JSON object of application-specific data. Untrusted metadata can be edited by end users directly via the SDK, and **cannot be used to store critical information.** See the [Metadata](/api-reference/consumer/api/resources/metadata) reference for complete field behavior details.
    </ResponseField>

    <ResponseField name="phone_numbers" type="array[objects]">
      An array of phone number objects linked to the User.

      <Expandable title="properties">
        <ResponseField name="phone_id" type="string">
          The unique ID for the phone number.
        </ResponseField>

        <ResponseField name="phone_number" type="string">
          The phone number.
        </ResponseField>

        <ResponseField name="verified" type="boolean">
          If this method has been successfully authenticated by the User.
        </ResponseField>
      </Expandable>
    </ResponseField>

    <ResponseField name="providers" type="array[objects]">
      An array of OAuth provider objects linked to the User.

      <Expandable title="properties">
        <ResponseField name="oauth_user_registration_id" type="string">
          The unique ID for an OAuth registration.
        </ResponseField>

        <ResponseField name="provider_subject" type="string">
          The unique identifier for the User within a given OAuth provider. Also commonly called the "sub" or "Subject field" in OAuth protocols.
        </ResponseField>

        <ResponseField name="provider_type" type="string">
          Denotes the OAuth identity provider that the user has authenticated with, e.g. Google, Facebook, GitHub etc.
        </ResponseField>

        <ResponseField name="profile_picture_url" type="string">
          If available, the profile\_picture\_url is a url of the User's profile picture set in OAuth identity the provider that the User has authenticated with, e.g. Facebook profile picture.
        </ResponseField>

        <ResponseField name="locale" type="string">
          If available, the locale is the User's locale set in the OAuth identity provider that the user has authenticated with.
        </ResponseField>
      </Expandable>
    </ResponseField>

    <ResponseField name="password" type="object">
      The password object is returned for users with a password.

      <Expandable title="properties">
        <ResponseField name="password_id" type="string">
          The unique ID of a specific password
        </ResponseField>

        <ResponseField name="requires_reset" type="boolean">
          Indicates whether this password requires a password reset
        </ResponseField>
      </Expandable>
    </ResponseField>

    <ResponseField name="status" type="string">
      The status of the User. The possible values are `pending` and `active`.
    </ResponseField>

    <ResponseField name="totps" type="array[objects]">
      An array containing a list of all TOTP instances for a given User in the Stytch API.

      <Expandable title="properties">
        <ResponseField name="totp_id" type="string">
          The unique ID for a TOTP instance.
        </ResponseField>

        <ResponseField name="verified" type="boolean">
          If this method has been successfully authenticated by the User.
        </ResponseField>
      </Expandable>
    </ResponseField>

    <ResponseField name="user_id" type="string">
      The unique ID of the affected User.
    </ResponseField>

    <ResponseField name="webauthn_registrations" type="array[objects]">
      An array that contains a list of all Passkey or WebAuthn registrations for a given User in the Stytch API.

      <Expandable title="properties">
        <ResponseField name="webauthn_registration_id" type="string">
          The unique ID for the Passkey or WebAuthn registration.
        </ResponseField>

        <ResponseField name="domain" type="string">
          The domain on which Passkey or WebAuthn registration was started. This will be the domain of your app.
        </ResponseField>

        <ResponseField name="user_agent" type="string">
          The user agent of the User.
        </ResponseField>

        <ResponseField name="authenticator_type" type="string">
          The authenticator\_type string displays the requested authenticator type of the Passkey or WebAuthn device. The two valid types are "platform" and "cross-platform". If no value is present, the Passkey or WebAuthn device was created without an authenticator type preference.
        </ResponseField>

        <ResponseField name="verified" type="boolean">
          If this method has been successfully authenticated by the User.
        </ResponseField>

        <ResponseField name="name" type="string">
          The name of the Passkey or WebAuthn registration.
        </ResponseField>
      </Expandable>
    </ResponseField>

    <ResponseField name="biometric_registrations" type="array[objects]">
      An array that contains a list of all biometric registrations for a given User in the Stytch API.

      <Expandable title="properties">
        <ResponseField name="biometric_registration_id" type="string">
          The unique ID for a biometric registration.
        </ResponseField>

        <ResponseField name="verified" type="boolean">
          If this method has been successfully authenticated by the User.
        </ResponseField>
      </Expandable>
    </ResponseField>

    <ResponseField name="roles" type="array[strings]">
      Roles assigned to this User. See the [RBAC guide](/consumer-auth/authorization/assigning-roles-to-users) for more information about role assignment.
    </ResponseField>
  </Expandable>
</ResponseField>

<ResponseField name="verdict" type="object">
  If an `authorization_check` is provided in the request and the check succeeds, this field will return information about why the User was granted permission.

  <Expandable title="properties">
    <ResponseField name="verdict.authorized" type="boolean" required="true">
      Whether the User was authorized to perform the specified action on the specified Resource. Always true if the request succeeds.
    </ResponseField>

    <ResponseField name="verdict.granting_roles" type="string[]" required="true">
      The complete list of Roles that gave the User permission to perform the specified action on the specified Resource.
    </ResponseField>
  </Expandable>
</ResponseField>

<ResponseField name="status_code" type="number">
  The HTTP status code of the response. Stytch follows standard HTTP response status code patterns, e.g. 2XX values
  equate to success, 3XX values are redirects, 4XX are client errors, and 5XX are server errors.
</ResponseField>

<ResponseField name="request_id" type="string">
  Globally unique UUID that is returned with every API call. This value is important to log for debugging purposes; we
  may ask for this value to help identify a specific API call when helping you debug an issue.
</ResponseField>

<Panel>
  <RequestExample>
    ```python Python SDK theme={null}
    from stytch import Client

    client = Client(
      project_id="project-test-8aed2e54-0266-4793-9b5e-0cc9c56064da",
      secret="secret-test-IJ7zLTgXp8xoS7yXO2xavNxZTbYfvm-2nZM=",
    )

    resp = client.sessions.authenticate_jwt(
      session_jwt="eyJ...",
    )

    print(resp)
    ```

    ```javascript Node SDK theme={null}
    const stytch = require('stytch');

    const client = new stytch.Client({
      project_id: 'project-test-8aed2e54-0266-4793-9b5e-0cc9c56064da',
      secret: 'secret-test-IJ7zLTgXp8xoS7yXO2xavNxZTbYfvm-2nZM=',
    });

    const params = {
      session_jwt: 'eyJ...',
    };

    client.sessions
      .authenticateJwt(params)
      .then((resp) => {
        console.log(resp);
      })
      .catch((err) => {
        console.log(err);
      });
    ```

    ```go Go SDK theme={null}
    package main

    import (
      "context"
      "log"

      "github.com/stytchauth/stytch-go/v9/stytch/consumer/stytchapi"
      "github.com/stytchauth/stytch-go/v9/stytch/consumer/sessions"
    )

    func main() {
      client, err := stytchapi.NewClient(
        "project-test-8aed2e54-0266-4793-9b5e-0cc9c56064da",
        "secret-test-IJ7zLTgXp8xoS7yXO2xavNxZTbYfvm-2nZM=",
      )
      if err != nil {
        log.Fatalf("error instantiating API client %s", err)
      }

      resp, err := client.Sessions.AuthenticateJWT(
        context.Background(),
        &sessions.AuthenticateParams{
          SessionJWT: "eyJ...",
        },
      )
      if err != nil {
        log.Println(err)
      }

      log.Println(resp)
    }
    ```

    ```ruby Ruby SDK theme={null}
    require 'stytch'

    client = Stytch::Client.new(
      project_id: "project-test-8aed2e54-0266-4793-9b5e-0cc9c56064da",
      secret: "secret-test-IJ7zLTgXp8xoS7yXO2xavNxZTbYfvm-2nZM="
    )

    resp = client.sessions.authenticate_jwt(
      session_jwt: "eyJ..."
    )

    puts resp
    ```

    ```bash cURL theme={null}
      # This is an SDK method that doesn't directly hit an API endpoint unless the JWT is expired.
      # It's only available via our backend SDKs.
    ```
  </RequestExample>

  <ResponseExample>
    ```json 200 - Local theme={null}
    {
      "session": {
        "attributes": {
          "ip_address": "203.0.113.1",
          "user_agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36"
        },
        "authentication_factors": [
          {
            "delivery_method": "email",
            "email_factor": {
              "email_address": "sandbox@stytch.com",
              "email_id": "email-test-81bf03a8-86e1-4d95-bd44-bb3495224953"
            },
            "last_authenticated_at": "2021-08-09T07:41:52Z",
            "created_at": "2021-08-09T07:41:52Z",
            "updated_at": "2021-08-09T07:41:52Z",
            "type": "magic_link"
          }
        ],
        "custom_claims": {
          "claim1": "value1",
          "claim2": "value2",
        },
        "expires_at": "2021-08-10T07:41:52Z",
        "last_accessed_at": "2021-08-09T07:41:52Z",
        "session_id": "session-test-fe6c042b-6286-479f-8a4f-b046a6c46509",
        "started_at": "2021-08-09T07:41:52Z",
        "user_id": "user-test-16d9ba61-97a1-4ba4-9720-b03761dc50c6",
      },
      "session_jwt": "example_jwt",
    }
    ```

    ```json 200 - Remote theme={null}
    {
      "status_code": 200,
      "request_id": "request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141",
      "session": {
        "attributes": {
          "ip_address": "203.0.113.1",
          "user_agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36"
        },
        "authentication_factors": [
          {
            "delivery_method": "email",
            "email_factor": {
              "email_address": "sandbox@stytch.com",
              "email_id": "email-test-81bf03a8-86e1-4d95-bd44-bb3495224953"
            },
            "last_authenticated_at": "2021-08-09T07:41:52Z",
            "created_at": "2021-08-09T07:41:52Z",
            "updated_at": "2021-08-09T07:41:52Z",
            "type": "magic_link"
          }
        ],
        "custom_claims": {
          "claim1": "value1",
          "claim2": "value2",
        },
        "expires_at": "2021-08-10T07:41:52Z",
        "last_accessed_at": "2021-08-09T07:41:52Z",
        "session_id": "session-test-fe6c042b-6286-479f-8a4f-b046a6c46509",
        "started_at": "2021-08-09T07:41:52Z",
        "user_id": "user-test-16d9ba61-97a1-4ba4-9720-b03761dc50c6",
      },
      "session_jwt": "example_jwt",
      "session_token": "mZAYn5aLEqKUlZ_Ad9U_fWr38GaAQ1oFAhT8ds245v7Q",
      "user": {...},
      "verdict": {...},
    }
    ```

    ```json 401 theme={null}
    {
      "status_code": 401,
      "request_id": "request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141",
      "error_type": "unauthorized_credentials",
      "error_message": "Unauthorized credentials.",
      "error_url": "https://stytch.com/docs/api/errors/401"
    }
    ```

    ```json 429 theme={null}
    {
      "status_code": 429,
      "request_id": "request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141",
      "error_type": "too_many_requests",
      "error_message": "Too many requests have been made.",
      "error_url": "https://stytch.com/docs/api/errors/429"
    }
    ```

    ```json 500 theme={null}
    {
      "status_code": 500,
      "request_id": "request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141",
      "error_type": "internal_server_error",
      "error_message": "Oops, something seems to have gone wrong, please reach out to support@stytch.com to let us know what went wrong.",
      "error_url": "https://stytch.com/docs/api/errors/500"
    }
    ```
  </ResponseExample>
</Panel>