How to use the local API to get the user from the payload-token?

zenwhiskersmeowlast year

7

• 

  jarrod_not_jared

  last year

  Not sure if it’s a coincidence or if you asked the same question on Reddit. But I answered there if anyone finds this thread

  
  
  https://www.reddit.com/r/PayloadCMS/comments/1gxo8g9/how_to_use_the_payloadtoken_with_the_local_api/?utm_source=share&utm_medium=mweb3x&utm_name=mweb3xcss&utm_term=1&utm_content=share_button
• 

  gfwgfwlast year

  payload.auth({ headers: request.headers })

• 

  zenwhiskersmeowlast year

  Thanks, I went to multiple cities and cried wolf!! Rly wanted to get unblocked on a Friday night. Hopefully it helps people that the issue is in two places.

  
  
  

  payload.auth() taking the headers is nice!! can trust payload for all the JWT verification, checking for tampering, extracting the claims... nice indeed

  
  
  

  good work everyone 🙂

  
  
  

  its working great

• 

  gfwgfwlast year

  also there are some utils in payload, you can decrypt the jwt manually

• 

  zenwhiskersmeowlast year

  where is that? i thought i had to pnpm add jose and use (await getPayload().secret) as the secret

  
  
  

  it seemed like payload wouldve given us something like this so i was suspicious i was duplicating effort

  
  
  

  even though my problem is solved it could be useful to verify the jwt manually in other use cases

• 

  gfwgfwlast year

  maybe this, packages/payload/src/auth/. Payload JWT is HS256, you can even write your own utils use jose or jsonwebtoken.

  
  

  somthing like:

  
  

  function isValidToken(token: string): boolean {
    // Implement your token validation logic here
    // This is just a placeholder example
    const hash = crypto
      .createHash('sha256')
      .update(process.env.PAYLOAD_SECRET || '')
      .digest('hex')
      .slice(0, 32)
    try {
      const decoded = jwt.verify(token, hash, { algorithms: ['HS256'] })
      return true
    } catch {
      return false
    }
  }

• 

  zenwhiskersmeowlast year

  thank you!