• Demonstrates how to validate JWTs in Golang using Ed25519 public keys in PEM format – required for Chainstack Marketplace apps.
• Explains parsing of EdDSA-signed JWT headers/payload with required audience matching and expiration checks.
• Walks through environment variable setup with .env, retrieving the public key, decoding the token, and returning the claims for a successful validation.
• Ensures robust security by verifying the token’s legitimacy and ensuring it is intended specifically for your application.

​

Introduction

​

What is JWT?

​

Why validate JWT?

​

What will you learn?

• Parse and decode Ed25519 public keys in PEM format.
• Validate JWTs using Ed25519 public keys.
• Verify the “audience” claim to ensure the JWT is intended for your application.

​

Prerequisites

• Go 1.16 or higher
• A text editor or IDE of your choice (e.g., Visual Studio Code)
• Terminal or command prompt for running shell commands

• Go programming language
• JSON web tokens (JWT)
• Public key infrastructure (PKI)

​

Setting up the project

1. Initialize a new Go project Open your terminal and run the following command to create a new directory for your project and navigate into it:
   Copy

   mkdir go-jwt-validation && cd go-jwt-validation
   

2. Initialize Go module Initialize a new Go module by running:
   Copy

   go mod init jwt-validation
   

3. Install required libraries Install the necessary Go libraries by running:
   Copy

   go get github.com/golang-jwt/jwt
   go get golang.org/x/crypto/ed25519
   go get github.com/joho/godotenv
   

4. Create a .env file Create a .env file in the root directory of your project and add the public key you received from Chainstack and other environment variables if needed.
   ​

   Ensure the public key is in the privacy-enhanced mail (PEM) format

   PEM is a widely used encoding format for cryptographic objects such as keys and certificates. It is a base64 encoding of the binary distinguished encoding rules (DER) format with additional header and footer lines. In the code, the public key is stored in PEM format between the lines -----BEGIN PUBLIC KEY----- and -----END PUBLIC KEY-----.
   Copy

   JWT_PUBLIC_KEY="-----BEGIN PUBLIC KEY-----PUBLIC_KEY_HERE-----END PUBLIC KEY-----"
   

​

Why use a .env file?

• Security — sensitive information like keys should not be hard-coded into your application.
• Portability — it’s easier to manage and change configuration when it’s separated from the code.
• Environment specificity — you can have different .env files for different environments like development, testing, and production.

​

The Chainstack Marketplace authentication flow

curl --location --request POST '<https://api.chainstack.com/v1/marketplace/applications/YOUR_APP_SLUG/token/>' \\
--header 'Authorization: Bearer CHAINSTACK_API_KEY'

​

Claims in a Chainstack Marketplace JWT

​

The code

package main

import (
	"crypto/x509"
	"encoding/pem"
	"fmt"
	"os"
	"strings" // Added this package for string manipulation
	"github.com/joho/godotenv"
	"github.com/golang-jwt/jwt"
	"golang.org/x/crypto/ed25519"
)

// loadEnvVars loads environment variables from .env file
func loadEnvVars() error {
	err := godotenv.Load()
	if err != nil {
		return fmt.Errorf("error loading .env file: %w", err)
	}
	return nil
}

// getPublicKey retrieves the public key from an environment variable
func getPublicKey() (ed25519.PublicKey, error) {
	publicPEM := os.Getenv("JWT_PUBLIC_KEY")
	if publicPEM == "" {
		return nil, fmt.Errorf("Environment variable for public key is not set")
	}

	// Convert single-line PEM to multi-line PEM if needed
	publicPEM = strings.Replace(publicPEM, "-----BEGIN PUBLIC KEY-----", "-----BEGIN PUBLIC KEY-----\n", 1)
	publicPEM = strings.Replace(publicPEM, "-----END PUBLIC KEY-----", "\n-----END PUBLIC KEY-----", 1)

	block, _ := pem.Decode([]byte(publicPEM))
	if block == nil {
		return nil, fmt.Errorf("Failed to parse PEM block containing the public key")
	}

	pubKey, err := x509.ParsePKIXPublicKey(block.Bytes)
	if err != nil {
		return nil, fmt.Errorf("Failed to parse public key: %w", err)
	}

	ed25519PubKey, ok := pubKey.(ed25519.PublicKey)
	if !ok {
		return nil, fmt.Errorf("Failed to convert public key to Ed25519 public key")
	}

	return ed25519PubKey, nil
}

// validateJWT validates the JWT token
func validateJWT(ed25519PubKey ed25519.PublicKey, jwtToken, expectedAudience string) error {
	token, err := jwt.Parse(jwtToken, func(token *jwt.Token) (interface{}, error) {
		return ed25519PubKey, nil
	})
	if err != nil {
		return fmt.Errorf("Failed to parse JWT token: %w", err)
	}

	// Print the JWT headers
	fmt.Println("JWT Headers:", token.Header)

	if claims, ok := token.Claims.(jwt.MapClaims); ok && token.Valid {
		audience, audienceOk := claims["aud"].(string)
		if audienceOk && audience == expectedAudience {
			fmt.Println("Decoded Payload:", claims)
			fmt.Println("Signature is valid.")
			return nil
		} else {
			return fmt.Errorf("Invalid Token: Invalid audience")
		}
	} else {
		return fmt.Errorf("Invalid Token: Token is not valid")
	}
}

func main() {
	err := loadEnvVars()
	if err != nil {
		fmt.Printf("Error occurred: %v\n", err)
		return
	}

	ed25519PubKey, err := getPublicKey()
	if err != nil {
		fmt.Printf("Error occurred: %v\n", err)
		return
	}

	// Add the JWT to validate
	jwtToken := "JWT_TO_VALIDATE"
	expectedAudience := "YOUR_COOL_APP"

	err = validateJWT(ed25519PubKey, jwtToken, expectedAudience)
	if err != nil {
		fmt.Printf("Error occurred: %v\n", err)
		return
	}
}

​

Understanding the code

​

Import statements

import (
	"crypto/x509"
	"encoding/pem"
	"fmt"
	"os"
	"strings"
	"github.com/joho/godotenv"
	"github.com/golang-jwt/jwt"
	"golang.org/x/crypto/ed25519"
)

• crypto/x509 and encoding/pem — these are standard Go libraries used for parsing the PEM-encoded public key.
• fmt — standard Go package for formatted I/O operations.
• os — standard Go package for interacting with the operating system, used here for reading environment variables.
• strings — standard Go package for string manipulation.
• github.com/joho/godotenv— this library loads environment variables from a .env file.
• github.com/golang-jwt/jwt — this library is used for parsing and validating JWTs.
• golang.org/x/crypto/ed25519 — this library provides the cryptographic operations for the Ed25519 algorithm.

​

Functions and their roles

​

loadEnvVars()

​

getPublicKey()

1. Reads the JWT_PUBLIC_KEY environment variable.
2. Checks if the variable is empty and returns an error if it is.
3. Converts the single-line PEM to multi-line PEM format if needed.
4. Decodes the PEM block to get the public key bytes.
5. Parses the public key bytes to get an ed25519.PublicKey object.

​

validateJWT()

1. Parse the JWT. Utilizes the jwt.Parse function from the github.com/golang-jwt/jwt library to parse the JWT. This function not only decodes the token but also validates it against a series of standard claims:
   • exp — expiration time of the token. If the token is expired, the function will return an error.
   • nbf — not-before time, indicating the earliest time the token is valid.
   • iat — issued-at time, indicating when the token was created.
   The function uses the provided Ed25519 public key for cryptographic validation of the token’s signature.
2. Check audience. Explicitly checks the aud claim in the token to ensure it matches the expected audience. This is an additional validation layer on top of the default checks performed by jwt.Parse. This claim ensures the user is allowed to call your app specifically.
3. Output. If the token is valid, it prints the decoded payload and a validation success message. If the token is invalid for any reason (e.g., expired, wrong audience, etc.), an error message is returned.

​

main()

1. Calls loadEnvVars() to load the environment variables.
2. Calls getPublicKey() to retrieve the public key.
3. Calls validateJWT() to validate the JWT.

​

How to run the code

1. Validate a JWT. To validate a JWT, you’ll need an authorized API key. Use the appropriate endpoint to validate the API key and obtain a JWT. Note that in a production setting, you’ll either need to require users to validate and send the JWT first or implement a flow in your app that validates the API key dynamically.
2. Add JWT and audience to the script. Once you’ve validated the JWT, add it to the corresponding variable inside the main function, along with your expected audience.
   go

   Copy

   jwtToken := "VALIDATED_JWT"
   expectedAudience := "YOUR_EXPECTED_AUDIENCE"
   

3. Run the program directly. Open your terminal, navigate to the directory containing validation.go, and run:
   Shell

   Copy

   go run validation.go
   

   This will compile and run your code in one step. If everything is set up correctly, you should see the decoded payload and a validation success message.

​

Typical responses

1. Success. If the JWT is valid and the audience matches, you’ll see output similar to the following:
   Copy

   JWT Headers: map[alg:EdDSA typ:JWT]
   Decoded Payload: map[aud:EXPECTED_AUDIENCE exp:TIMESTAMP iat:TIMESTAMP iss:ISSUER nbf:TIMESTAMP scope:[com.APP.api.Paid] sub:SUBJECT]
   Signature is valid.
   

   ​

   The actual values will vary based on the JWT and your application

   At this point, you have a flow to validate JWTs and give access to users!
2. Failure. If the JWT is expired, you’ll see an error message like:
   Copy

   Error occurred: Failed to parse JWT token: Token is expired
   

​

Conclusion

​

About the author

Davide Zambiasi

Developer Advocate @ Chainstack BUIDLs on EVM, The Graph protocol, and Starknet Helping people understand Web3 and blockchain development