> ## Documentation Index
> Fetch the complete documentation index at: https://upstash-fix-issues-on-docs.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Verify Signatures

We send a JWT with each request. This JWT is signed by your individual secret
signing keys and sent in the `Upstash-Signature` HTTP header.

To verify the jwt you can choose from a
[wide array of open source libraries](https://jwt.io/libraries), or roll your
own solution.

## Claims

All claims in the JWT are listed [here](/qstash/features/security#claims)

## Verifying

The exact implementation depends on the language of your choice and the library
if you use one.

Instead here are the steps you need to follow:

1. Split the JWT into its header, payload and signature
2. Verify the signature
3. Decode the payload and verify the claims
   * `iss`: The issuer must be`Upstash`.
   * `sub`: The subject must the url of your API.
   * `exp`: Verify the token has not expired yet.
   * `nbf`: Verify the token is already valid.
   * `body`: Hash the raw request body using `SHA-256` and compare it with the
     `body` claim.

You can also reference the implementation in our
[typescript sdk](https://github.com/upstash/sdk-qstash-ts/blob/main/src/receiver.ts#L82) or use
the methods provided in the SDKs:

<CodeGroup>
  ```typescript Typescript
  import { Receiver } from "@upstash/qstash";

  const receiver = new Receiver({
    currentSigningKey: "YOUR_CURRENT_SIGNING_KEY",
    nextSigningKey: "YOUR_NEXT_SIGNING_KEY",
  });

  // ... in your request handler

  const signature = req.headers["Upstash-Signature"];
  const body = req.body;

  const isValid = receiver.verify({
    body,
    signature,
    url: "YOUR-SITE-URL",
  });
  ```

  ```python Python
  from upstash_qstash import Receiver

  receiver = Receiver({
    "current_signing_key": "YOUR_CURRENT_SIGNING_KEY",
    "next_signing_key": "YOUR_NEXT_SIGNING_KEY",
  })

  # ... in your request handler

  signature, body = req.headers["Upstash-Signature"], req.body

  is_valid receiver.verify({
    "body": body,
    "signature": signature,
    "url": "YOUR-SITE-URL"
  })
  ```
</CodeGroup>

After you have verified the signature and the claims, you can be sure the
request came from Upstash and process it accordingly.