> For the complete documentation index, see [llms.txt](https://docs.msquared.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.msquared.io/creation/unreal-development/features-and-tutorials/web-services/validating-identity.md).

# Identity Validation

How to validate user and Unreal server identity in your web api

If you have called 'Fetch M2 Web Platform Delegated Auth Token' and passed into HTTP blueprint nodes, your request to web servers will contain a token that can be used to prove the sender is either a logged-in client, or the game server.

<figure><img src="https://1456550285-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoWTlPaoHd1McSakqMigu%2Fuploads%2Fgit-blob-32c552e636c38a4a1048dcde500951524088fd64%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

This JWT is very short-lived (expiry \~5 minutes) and is designed to prove the identity of the caller as having come from the MSquared platform.

The token has the following payload for clients:

```
{
  "scopes": [],
  "user_id": "<userid>",
  "iat": 1717077960,
  "iss": "<issuer>:auth",
  "exp": 1717078260,
  "aud": [
    "<aud>"
  ]
}
```

And the following payload for the game server:

{% hint style="warning" %}
Unreal Servers only support 'World' scope of tokens, other types will not be generated
{% endhint %}

```
{
  "scopes": [],
  "client_type": "ue_server",
  "iat": 1717077960,
  "iss": "<issuer>:auth",
  "exp": 1717078260,
  "aud": [
    "<aud>"
  ]
}
```

{% hint style="danger" %}
The `client_type` claim being set to `ue_server` **does not mean that the requester is trustworthy.**

This claim will have the same value in delegated auth tokens for local and user-generated worlds.

Some additional gating is **strongly recommended** when relying on this claim, e.g. checking the project ID claim as well.
{% endhint %}

The JWT token header will contain a key id claim `(kid)` which can be used to validate the token using the JWKS published at <https://admin.m2worlds.io/.well-known/jwks.json>

The token can be validated using any JWT validation library, for example [jose](https://github.com/panva/jose) for JavaScript/Typescript users.

The current issuer in use is `scarcely-calm-lark:auth` and the audience is `scarcely-calm-lark`

```typescript
import * as jose from 'jose'

const JWKS = jose.createRemoteJWKSet(new URL('https://admin.m2worlds.io/.well-known/jwks.json'))
const { payload, protectedHeader } = await jose.jwtVerify(jwt, JWKS, {
  issuer: 'scarcely-calm-lark:auth',
  audience: 'scarcely-calm-lark',
})
```

If the token validates successfully, you can use the `user_id` or `ue_server` claim to identify the caller.

If you specified a scope in the request, then your token will contain additional claims depending on the scope. For example, if you requested world scope for a user:

```
{
  "scopes": [],
  "user_id": "<userid>",
  "organization_id": "<orgid>",
  "project_id": "<projectid>",
  "world_id": "<worldid>",
  "iat": 1717077960,
  "iss": "<issuer>:auth",
  "exp": 1717078260,
  "aud": [
    "<aud>"
  ]
}
```

It is recommended that you verify the tokens contain the organization, project and world claims you expect.