title: JWT Introspection middleware with a Web API - Java and Identity Server
body: <p>I am currently using Identity Server 4 which is .Net Core based to issue JWT tokens.  I have a .Net Core web api that has middleware in order for the JWT to be validated in the <code>Startup.cs</code>:</p>
  
  <pre><code>services.AddAuthentication("Bearer")
                  .AddJwtBearer("Bearer", options =&gt;
                  {
                      options.Authority = "http://localhost:5005";
                      options.Audience = "api1";
                  });
  </code></pre>
  
  <p>As we can see, its not asking for much except the location of the token server and who the api is which is `api1.  Obviously, its doing some more complex things under the hood.</p>
  
  <p>I found a Java based equivalent to the middleware above, which validates a JWT:</p>
  
  <pre><code>String token = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXUyJ9.eyJpc3MiOiJhdXRoMCJ9.AbIJTDMFc7yUa5MhvcP03nJPyCPzZtQcGEp-zWfOkEE";
  RSAPublicKey publicKey = //Get the key instance
  RSAPrivateKey privateKey = //Get the key instance
  try {
      Algorithm algorithm = Algorithm.RSA256(publicKey, privateKey);
      JWTVerifier verifier = JWT.require(algorithm)
          .withIssuer("auth0")
          .build(); //Reusable verifier instance
      DecodedJWT jwt = verifier.verify(token);
  } catch (JWTVerificationException exception){
      //Invalid signature/claims
  }
  </code></pre>
  
  <p>This is from <a href="https://github.com/auth0/java-jwt" rel="nofollow noreferrer">HERE</a> as was recommended by the <code>jwt.io</code> site.</p>
  
  <p>Basically I want to be able to implement something in Java that is doing the same thing as the .Net Core code above, but its clearly asking for things like a <code>Public</code> and <code>Private</code> key that I have no idea how to provide at this point, as the JWT is coming through the header of the request.</p>