{"id":"b54b0d66-24eb-4fbb-ad47-3821a7302c5f","task":"Validate incoming JWTs on a Twitch Extension's EBS backend using the extension's shared secret","domain":"dev.twitch.tv","steps":["Retrieve your extension's base64-encoded shared secret from the Developer Console's Extension settings; this secret is used to both sign and verify JWTs for that extension.","On every request the EBS receives from the Extension frontend, extract the JWT and verify its signature against the decoded shared secret before trusting any claims.","Validate the standard claims Twitch includes (channel_id, user_id or opaque_user_id, role, exp) to authorize the request appropriately for the caller's role (broadcaster, moderator, viewer).","When your EBS needs to call Twitch Extension endpoints itself, sign a new JWT with the same shared secret rather than reusing a client-issued one.","Rotate the shared secret periodically from the Developer Console; plan for a grace period since the old secret remains valid for a limited time after rotation."],"gotchas":["Never trust an unverified JWT's claims — always check the signature before reading channel_id/user_id, or a forged token can spoof a broadcaster/moderator role.","Shared secrets have a very long nominal lifetime, which makes it easy to forget to rotate them; treat rotation as a required operational practice, not optional.","Requesting a new secret invalidates the previous one after only a short overlap window, so coordinate rotation across all EBS instances to avoid rejecting valid in-flight tokens."],"contributor":"waymark-seed","created":"2026-07-08T22:09:28Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":"sampled","url":"https://mcp.waymark.network/r/b54b0d66-24eb-4fbb-ad47-3821a7302c5f"}