# JwT security - "verifyAccessToken" PHP SDK?

**URL:** <https://devforum.okta.com/t/jwt-security-verifyaccesstoken-php-sdk/19511>\
**Category:** Questions\
**Created:** [February 22, 2022, 5:37pm UTC](https://devforum.okta.com/t/jwt-security-verifyaccesstoken-php-sdk/19511 "2022-02-22T17:37:36Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![gstamp](https://avatars.discourse-cdn.com/v4/letter/g/bcef8e/32.png) [@gstamp](https://devforum.okta.com/u/gstamp)\
**Post date:** [February 22, 2022, 5:37pm UTC](https://devforum.okta.com/t/jwt-security-verifyaccesstoken-php-sdk/19511/1 "2022-02-22T17:37:36Z")

</div>

I’m am trying to understand what specifically this package is doing to “verify” the token:

> **[GitHub - okta/okta-jwt-verifier-php: A helper library for working with JWT's...](https://github.com/okta/okta-jwt-verifier-php)**
>
> A helper library for working with JWT's for Okta. Contribute to okta/okta-jwt-verifier-php development by creating an account on GitHub.

> verifyAccessToken  
> This will validate your JWT for the following:
> 
> - token expiration time
> - the time it was issue at
> - that the token issuer matches the expected value passed into the above helper
> - that the token audience matches the expected value passed into the above helper

Does this mean that the signature of the token is checked, and then the token is decoded and these verification checks are done? or does it mean that it just decodes the token and does these checks?

Thanks,  
gstamps

---

<div class="post-metadata">

**Author:** ![erik](https://avatars.discourse-cdn.com/v4/letter/e/b5ac83/32.png) [@erik](https://devforum.okta.com/u/erik)\
**Post date:** [February 23, 2022, 9:08pm UTC](https://devforum.okta.com/t/jwt-security-verifyaccesstoken-php-sdk/19511/2 "2022-02-23T21:08:54Z")

</div>

Hello,

Yes, it relies on Firebase JWT to decode which verifies the signature.  
[https://github.com/firebase/php-jwt/blob/main/src/JWT.php](https://github.com/firebase/php-jwt/blob/main/src/JWT.php)

---

<div class="post-metadata">

**Author:** ![gstamp](https://avatars.discourse-cdn.com/v4/letter/g/bcef8e/32.png) [@gstamp](https://devforum.okta.com/u/gstamp)\
**Post date:** [March 1, 2022, 11:30pm UTC](https://devforum.okta.com/t/jwt-security-verifyaccesstoken-php-sdk/19511/3 "2022-03-01T23:30:34Z")

</div>

Thank you Erik, much appreciated.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/oktadev/original/1X/589c4c5f80de422d01f47cee7185a7fb8227835c.png) [@system](https://devforum.okta.com/u/system)\
**Post date:** [March 2, 2022, 11:31pm UTC](https://devforum.okta.com/t/jwt-security-verifyaccesstoken-php-sdk/19511/4 "2022-03-02T23:31:23Z")

</div>

This topic was automatically closed 24 hours after the last reply. New replies are no longer allowed.