phonelink/validate

Exports

The phonelink/validate entry point exports the following:

Export	Type	Description
`validate`	`function`	Verifies a Phonelink JWT token
`PhonelinkPayload`	`type`	TypeScript type for the decoded JWT payload

Verifies a Phonelink JWT token against the JWKS endpoint.

Parameter	Type	Description
`token`	`string`	The JWT returned from the client verification flow
`expectedNonce`	`string`	The nonce returned alongside the token, for replay protection
`expectedAud`	`string`	Your Phonelink client ID (must match the token's `aud` claim)

Promise<PhonelinkPayload>

Resolves with the verified payload on success.

Error	Cause
`JWSSignatureVerificationFailed`	JWT signature does not match the JWKS keys
`JWTClaimValidationFailed`	Issuer is not `https://phone.link`, or audience doesn't match `expectedAud`
`JWTExpired`	Token has expired
`Error("Nonce mismatch")`	`payload.nonce` does not equal `expectedNonce`
`Error("Phone number not verified")`	`payload.verified` is not `true`

Fetches the public keys from https://phone.link/.well-known/jwks.json (cached automatically)
Verifies the JWT signature
Checks the iss claim equals https://phone.link
Checks the aud claim equals expectedAud
Checks the token has not expired
Checks payload.nonce equals expectedNonce
Checks payload.verified is true

TypeScript interface for the decoded JWT payload returned by validate.

Property	Type	Description
`phone_e164`	`string`	Verified phone number in E.164 format (e.g. `"+14155551234"`)
`verified`	`boolean`	Whether the phone number was successfully verified
`method`	`string`	Verification method used (e.g. SMS, voice call)
`provider`	`string`	Verification provider that handled the verification
`nonce`	`string`	Cryptographic nonce for replay protection
`sub`	`string`	Subject identifier for the verification session
`iss`	`string`	Token issuer (always `"https://phone.link"`)
`aud`	`string`	Audience (your Phonelink client ID)
`iat`	`number`	Unix timestamp (seconds) when the token was issued
`exp`	`number`	Unix timestamp (seconds) when the token expires
`jti`	`string`	Unique identifier for this specific token

import type { PhonelinkPayload } from "phonelink/validate";