title: How to validate and decode a JWT created by an asp.net Web-Api in JavaScript
body: <p>I have been following <a href="http://bitoftech.net/2014/10/27/json-web-token-asp-net-web-api-2-jwt-owin-authorization-server/" rel="nofollow noreferrer">this tutorial</a> on how to create JWT authorization in an asp.net Web API application.</p>
  
  <p>In my case the authentication server will be the same server holding the resources (ie all done in the one asp.net Web API application), so I can see that sharing the "secret" used in encoding the JWT is not a problem when it come to the route authentication and authorization.</p>
  
  <p>However, I will have have an Mobile application (using the Ionic framework) where I would like to be able to validate and decode the JWT so that I can enable/disable different parts of the UI. So I will need to do this in JavaScript.</p>
  
  <p>So, I would not want the application to have access to this "secret" string used to encode the JWT.</p>
  
  <p>My questions are</p>
  
  <ol>
  <li><p>How can I both validate and decode a JWT without having to have this "secret" key?</p></li>
  <li><p>Reading other posts, perhaps the validation is not possible, but decoding is. In this case there is the possibility of incorrect UI enabling, but in the end the web API call will fails as this can do the validation as well. Is this the correct way to go about it</p></li>
  <li><p>Is there another way of creating the JWT where we have private and public   key, so the JavaScript can have the public key and use this for the validation?</p></li>
  </ol>
  
  <p>Thanks in advance for any help!</p>