getClaims

abstract suspend fun getClaims(jwt: String? = null, options: ClaimsRequestBuilder.() -> Unit = {}): ClaimsResponse(source)

Extracts the JWT claims present in the access token by first verifying the JWT against the server's JSON Web Key Set endpoint /.well-known/jwks.json which is often cached, resulting in significantly faster responses. Prefer this method over retrieveUser which always sends a request to the Auth server for each JWT.

If the project is not using an asymmetric JWT signing key (like ECC or RSA) it always sends a request to the Auth server (similar to retrieveUser) to verify the JWT.

Parameters

jwt

An optional specific JWT you wish to verify, not the one you can obtain from currentSessionOrNull.

options

Various additional options that allow you to customize the behavior of this method.

Throws

when trying to get the claims of an expired jwt and ClaimsRequestBuilder.allowExpired is set to false

if the jwt is invalid

on any REST-related error responses during the fetching of the JWKs or retrieving of the current user data