v150 · Web APIs · Authentication

Token Decoder

EVP tokens are JWTs. Paste an EVP token and decode its three parts — JOSE header, claims payload, and signature. The decoder surfaces the email, iss, aud, exp, and nonce claims your server must verify before trusting the proof of ownership.

EVP is an experimental protocol — tokens shown here are for demonstration only. In production, verify the signature against the mail provider's public key before trusting any claim.

claims your server must verify

// Server-side EVP token verification (Node.js pseudocode)
const jwt = require('jsonwebtoken');
const { publicKey } = await fetchMailProviderPublicKey(token.iss);

const claims = jwt.verify(token, publicKey, {
  algorithms: ['ES256'],
  audience: 'https://yoursite.example.com',  // must match aud
});

// Verify the nonce matches the one you sent to the browser
if (claims.nonce !== session.expectedNonce) throw new Error('nonce mismatch');

// Email ownership proven
const verifiedEmail = claims.email;

see also

implementation reference

Need the exact API surface, compatibility boundaries, errors, lifecycle, and source links? Read the matching gendn reference ↗