Auth0 PHP - manually authenticating JWT idTokens
The author criticizes Auth0's poor documentation and provides a guide on manually authenticating a JWT idToken after user authentication. Only the idToken is needed, not the accessToken.
Background
- **Auth0** (owned by **Okta**) is a popular identity platform that handles login and user management for websites and apps. It issues **JSON Web Tokens (JWTs)** — signed data blobs that prove a user is who they say they are.
- When a user logs in, Auth0 gives the app an **accessToken** (for calling APIs) and an **idToken** (containing the user's profile info). The post focuses on verifying the idToken manually in PHP.
- "Manually authenticating" means writing custom PHP code to decode and cryptographically verify the JWT's signature — instead of using Auth0's official PHP SDK library. The author does this because they find Auth0's documentation lacking.
- JWT verification is security-critical: if a server blindly trusts a forged token, an attacker can impersonate any user. The post walks through the necessary cryptographic steps that many official docs gloss over.