Verify Signatures

We send a JWT with each request. This JWT is signed by your individual secret signing key and sent in the Upstash-Signature HTTP header.

You can use this signature to verify the request is coming from QStash.

​

Verifying

You can use the official QStash SDKs or implement a custom verifier either by using an open source library or by processing the JWT manually.

​

Via SDK (Recommended)

QStash SDKs provide a Receiver type that simplifies signature verification.

​

Manual verification

If you don’t want to use the SDKs, you can implement your own verifier either by using an open-source library or by manually processing the JWT.

The exact implementation depends on the language of your choice and the library if you use one. Instead here are the steps you need to follow:

1. Split the JWT into its header, payload and signature
2. Verify the signature
3. Decode the payload and verify the claims
   • iss: The issuer must beUpstash.
   • sub: The subject must the url of your API.
   • exp: Verify the token has not expired yet.
   • nbf: Verify the token is already valid.
   • body: Hash the raw request body using SHA-256 and compare it with the body claim.

You can also reference the implementation in our Typescript SDK.

After you have verified the signature and the claims, you can be sure the request came from Upstash and process it accordingly.

​

Claims

All claims in the JWT are listed here