{"id":17799,"date":"2016-07-12T13:47:55","date_gmt":"2016-07-12T13:47:55","guid":{"rendered":"http:\/\/apidocs.kore.com\/?post_type=docs&#038;p=3749"},"modified":"2024-01-04T10:45:01","modified_gmt":"2024-01-04T10:45:01","slug":"user-authorization-and-assertion","status":"publish","type":"post","link":"https:\/\/developer.kore.ai\/v10-1\/docs\/bots\/sdks\/user-authorization-and-assertion\/","title":{"rendered":"SDK Security"},"content":{"rendered":"<section class=\"l-section wpb_row height_auto\"><div class=\"l-section-h i-cf\"><div class=\"g-cols vc_row type_default valign_top\"><div class=\"vc_col-sm-12 wpb_column vc_column_container\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\">\r\n\t<div class=\"wpb_text_column \">\r\n\t\t<div class=\"wpb_wrapper\">\r\n\t\t\t<p>The Kore.ai XO Platform only accepts clients that are authorized to connect and exchange messages. You must register your SDK app with the Kore.ai XO Platform in the XO Platform tool and acquire client credentials. You can then use your client\u00a0credentials to authorize the app and\u00a0communication exchange between your user, bot, and the XO Platform.<\/p>\n\r\n\t\t<\/div>\r\n\t<\/div>\r\n<div class=\"w-separator size_small with_line width_default thick_1 style_solid color_border align_center\"><div class=\"w-separator-h\"><\/div><\/div>\r\n\t<div class=\"wpb_text_column \">\r\n\t\t<div class=\"wpb_wrapper\">\r\n\t\t\t<h2><span class=\"ez-toc-section\" id=\"Securing_Your_SDKs\">Securing Your SDKs<\/span><\/h2>\n<p>Using Kore.ai SDKs, you can create secure interactions with the Kore.ai XO Platform.<br \/>\nKore.ai SDK libraries can be embedded with web or mobile applications to make HTTPS calls and establish web socket connections with the Kore.ai XO Platform on behalf of a user of your application chatting with a Kore.ai bot.<br \/>\nTo establish identity and initiate a secure web session:<\/p>\n<ul>\n<li>Your application SDK should sign and send the identity of the user to the Kore.ai XO Platform<\/li>\n<li>The Kore.ai XO Platform verifies the signature to establish trust with your application using:\n<ul>\n<li><strong>JSON Web Token (JWT)<\/strong> &#8211; Used to send the user identity to Kore.ai XO Platform<\/li>\n<li><strong>Bearer Token<\/strong> &#8211; Your application SDK exchanges the JWT for a\u00a0bearer token used for subsequent calls<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\r\n\t\t<\/div>\r\n\t<\/div>\r\n<div class=\"w-separator size_small with_line width_default thick_1 style_solid color_border align_center\"><div class=\"w-separator-h\"><\/div><\/div>\r\n\t<div class=\"wpb_text_column \">\r\n\t\t<div class=\"wpb_wrapper\">\r\n\t\t\t<h3><span class=\"ez-toc-section\" id=\"About_JWT\">About JWT<\/span><\/h3>\n<p>Kore.ai uses the JWT (JSON Web Token) mechanism to handle the authentication.<\/p>\n<h4>JWT Flow<\/h4>\n<p>The following diagram depicts a typical\u00a0JWT flow in Kore.ai XO Platform.<br \/>\n<a ref=\"magnificPopup\" href=\"\/wp-content\/uploads\/sites\/35\/JWT-simplified-1.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-16999\" src=\"\/wp-content\/uploads\/sites\/35\/JWT-simplified-1.png\" alt=\"\" width=\"719\" height=\"465\" \/><\/a><\/p>\n<h4>JWT Tokens<\/h4>\n<p>JSON Web Tokens\u00a0consist of three parts separated by dots &#8221; . \u00a0&#8221; as:<\/p>\n<ul>\n<li>Header<\/li>\n<li>Payload<\/li>\n<li>Signature<\/li>\n<\/ul>\n<p>using the\u00a0<code>hhhhh.ppppp.sssss<\/code> syntax where h represents the header, p the payload, and s representing the signature.<\/p>\n<h4>JWT Header<\/h4>\n<p>The JWT Header\u00a0defines the token type, which is JWT, and the security algorithm, for example,<\/p>\n<pre class=\"lang:default decode:true \">{\r\n   \"alg\": \"HS256\",\r\n   \"typ\": \"JWT\"\r\n}<\/pre>\n<p>The JWT type can be one of:<\/p>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>HS256 \/ HS512 (HMAC with SHA-256 \/ SHA-512) <\/b><span style=\"font-weight: 400;\">\u2013 These algorithms use a <\/span><b>Secret Key<\/b><span style=\"font-weight: 400;\"> to sign the token. The <\/span><b>Secret Key<\/b><span style=\"font-weight: 400;\"> is generated when the app is registered on the XO Platform when defining your bot&#8217;s Web\/Mobile Client channel.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>RS256 \/ RS512 (RSA signature with SHA-256 \/ SHA-512)<\/b><span style=\"font-weight: 400;\"> \u2013 These are RSA public\/private key-based algorithms to sign and verify the token. The client <\/span><b>Public Key<\/b><span style=\"font-weight: 400;\"> is defined when the app is registered on the XO Platform. The client app signs the token using a <\/span><b>Private Key<\/b><span style=\"font-weight: 400;\">, and the XO Platform verifies this token using the <\/span><b>Public Key<\/b><span style=\"font-weight: 400;\">.<\/span><\/li>\n<\/ul>\n<p>To use these JWT types for your bot, you need to register your application and select the algorithm type. For more information about using JWT, see\u00a0 <a href=\"https:\/\/tools.ietf.org\/html\/rfc7519\">https:\/\/tools.ietf.org\/html\/rfc7519<\/a> and <a href=\"https:\/\/jwt.io\/introduction\/\">https:\/\/jwt.io\/introduction\/<\/a>.<\/p>\n<h4>JWT Payload<\/h4>\n<p>The SDK client needs to assert the user by generating unique JSON Web Token using your app registration credentials created in XO Platform when you defined the Web\/Mobile Client channel for your bot and the identity of your app user.<\/p>\n<p>The following example shows a\u00a0sample payload used\u00a0to generate the JWT.<br \/>\n<strong>Sample Header<\/strong><\/p>\n<pre class=\"toolbar:1 lang:default decode:true\">{\r\n    \"alg\": \"HS256\",\r\n    \"typ\": \"JWT\"\r\n}<\/pre>\n<p><strong>Sample Payload<\/strong><\/p>\n<pre class=\"toolbar:1 lang:default decode:true\">{\r\n    \"iat\": 1466684723,\r\n    \"exp\": 1466684783,\r\n    \"jti\": \"1234\",               \/\/or kore_jti\r\n    \"aud\": \"https:\/\/idproxy.kore.ai\/authorize\",\r\n    \"iss\": \"cs-xxxxxxxxxx-1234\", \/\/or kore_iss\r\n    \"sub\": \"john.doe@achme.com\", \/\/or kore_sub\r\n    \"isAnonymous\": false,\r\n    \"identityToMerge\": \"anonymoususer1@test.com\" \/\/to map anonymous user\r\n}<\/pre>\n<p>The following table describes the parameters for the JWT Header and Payload.<\/p>\n<table style=\"height: 973px;\">\n<thead>\n<tr style=\"height: 18px;\">\n<th style=\"height: 18px; width: 111.656px;\">Parameter<\/th>\n<th style=\"height: 18px; width: 490.172px;\">Description<\/th>\n<th style=\"height: 18px; width: 55.1719px;\">Type<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr style=\"height: 187px;\">\n<td style=\"height: 187px; width: 111.656px;\">alg<\/td>\n<td style=\"height: 187px; width: 490.172px;\">A drop-down list of security algorithms. One of:<\/p>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>RS256\/<\/b><b>RS512<\/b><b>: <\/b><span style=\"font-weight: 400;\">Select to enable the <\/span><b>Public Key.<\/b> <i><span style=\"font-weight: 400;\">The Private key, used for encryption, is provided by the user, and the Public key, used for decryption, is provided by the Platform<\/span><\/i><span style=\"font-weight: 400;\">. Both the keys have to be used for generating the token.<\/span><span style=\"font-weight: 400;\"> The Public Key is used by the XO Platform to authenticate the client application.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>HS256\/<\/b><b>HS512<\/b><b>:<\/b><span style=\"font-weight: 400;\"> Select to generate a <\/span><b>Secret Key <\/b><span style=\"font-weight: 400;\">and a <\/span><b>Client ID<\/b><span style=\"font-weight: 400;\">. The <\/span><b>Client ID<\/b><span style=\"font-weight: 400;\"> is required for app initialization, and the <\/span><b>Secret Key<\/b><span style=\"font-weight: 400;\"> is used by the XO Platform to authenticate the client application.<\/span><\/li>\n<\/ul>\n<\/td>\n<td style=\"height: 187px; width: 55.1719px;\">string<\/td>\n<\/tr>\n<tr style=\"height: 18px;\">\n<td style=\"height: 18px; width: 111.656px;\">typ<\/td>\n<td style=\"height: 18px; width: 490.172px;\">The token type. For JSON Web Token, enter <strong>JWT<\/strong>.<\/td>\n<td style=\"height: 18px; width: 55.1719px;\">string<\/td>\n<\/tr>\n<tr style=\"height: 36px;\">\n<td style=\"height: 36px; width: 111.656px;\">iat<\/td>\n<td style=\"height: 36px; width: 490.172px;\">The date\/time that the token was issued. This value should be in seconds.<\/td>\n<td style=\"height: 36px; width: 55.1719px;\">integer<\/td>\n<\/tr>\n<tr style=\"height: 36px;\">\n<td style=\"height: 36px; width: 111.656px;\">exp<\/td>\n<td style=\"height: 36px; width: 490.172px;\">The date\/time that the token expires. This value should be in seconds.<\/td>\n<td style=\"height: 36px; width: 55.1719px;\">integer<\/td>\n<\/tr>\n<tr style=\"height: 257px;\">\n<td style=\"height: 257px; width: 111.656px;\">jti<\/p>\n<p>or kore_jti<br \/>\n(optional)<\/td>\n<td style=\"height: 257px; width: 490.172px;\">A <em>jti claim<\/em> which can be used to prevent replay attacks:<\/p>\n<p>&#8220;<em>The &#8220;jti&#8221; (JWT ID) claim provides a unique identifier for the JWT. The identifier value MUST be assigned in a manner that ensures that there is a negligible probability that the same value will be accidentally assigned to a different data object; if the application uses multiple issuers, collisions MUST be prevented among values produced by different issuers as well. The &#8220;jti&#8221; claim can be used to prevent the JWT from being replayed. The &#8220;jti&#8221; value is a case-sensitive string. Use of this claim is OPTIONAL.<\/em>&#8221; (<a href=\"https:\/\/tools.ietf.org\/html\/rfc7519#section-4.1.7\" target=\"_blank\" rel=\"noopener noreferrer\">ref<\/a>)<\/p>\n<p>NOTE: Use\u00a0<em>kore_jti<\/em> to bypass the pre-populated value for\u00a0<em>jti<\/em> with Kore specific values<\/td>\n<td style=\"height: 257px; width: 55.1719px;\">string<\/td>\n<\/tr>\n<tr style=\"height: 36px;\">\n<td style=\"height: 36px; width: 111.656px;\">aud<\/td>\n<td style=\"height: 36px; width: 490.172px;\">The audience that the token is intended for. For Kore.ai, the audience is https:\/\/idproxy.kore.com\/authorize.<\/td>\n<td style=\"height: 36px; width: 55.1719px;\">string<\/td>\n<\/tr>\n<tr style=\"height: 114px;\">\n<td style=\"height: 114px; width: 111.656px;\">iss<\/p>\n<p>or kore_iss<\/td>\n<td style=\"height: 114px; width: 490.172px;\">The ClientID of the client application. The ClientID is generated when the app is registered in the Kore.ai XO Platform.<\/p>\n<p>NOTE: Use\u00a0<em>kore_iss<\/em>\u00a0to bypass the pre-populated value for\u00a0<em>iss<\/em> with Kore specific values<\/td>\n<td style=\"height: 114px; width: 55.1719px;\">string<\/td>\n<\/tr>\n<tr style=\"height: 151px;\">\n<td style=\"height: 151px; width: 111.656px;\">sub<\/p>\n<p>or kore_sub<\/td>\n<td style=\"height: 151px; width: 490.172px;\">The token subject which is represented by the email ID or phone number for users who are logged in the client application system. For anonymous users, the client app can generate a unique random ID and assign that ID to this field.<\/p>\n<p>NOTE: Use\u00a0<em>kore_sub<\/em>\u00a0to bypass the pre-populated value for\u00a0<em>sub<\/em> with Kore specific values<\/td>\n<td style=\"height: 151px; width: 55.1719px;\">string<\/td>\n<\/tr>\n<tr style=\"height: 56px;\">\n<td style=\"height: 56px; width: 111.656px;\">isAnonymous<\/td>\n<td style=\"height: 56px; width: 490.172px;\">When set to <code>true<\/code>, the user is an anonymous user for the client application system. Anonymous users are not persisted on the Kore.ai Platform. Default setting is <code>false<\/code>.<\/td>\n<td style=\"height: 56px; width: 55.1719px;\">boolean<\/td>\n<\/tr>\n<tr style=\"height: 64px;\">\n<td style=\"height: 64px; width: 111.656px;\">identityToMerge<\/td>\n<td style=\"height: 64px; width: 490.172px;\">The anonymous Identity that needs to be merged into known user<br \/>\n<a href=\"\/docs\/bots\/sdks\/kore-ai-web-sdk-tutorial\/#Passing_Mapped_Identities_webSDK\" target=\"_blank\" rel=\"noopener noreferrer\">refer here<\/a> for details<\/td>\n<td style=\"height: 64px; width: 55.1719px;\">string<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h4>jti Validations<\/h4>\n<p>In case jti claim is passed as part of the JWT payload, the Platform performs the following validations:<\/p>\n<ol>\n<li>Expiry to be less than or equal to 1 hour: In case of failing to meet this requirement the following response is sent:\n<pre class=\"toolbar:1 lang:default decode:true\">{\"errors\":[{\"msg\":\"error verifying the jwt: if \\\"jti\\\" claim \\\"exp\\\" must be &lt;= 1 hour(s)\",\"code\":401}]}<\/pre>\n<\/li>\n<li>Restricts replay of XHR: The following response is sent in case of non-compliance:\n<pre class=\"toolbar:1 lang:default decode:true\">{\"errors\":[{\"msg\":\"error verifying the jwt: possibly a replay\",\"code\":401}]}<\/pre>\n<\/li>\n<\/ol>\n<h4>Hosting the JWT Generation Web Service<\/h4>\n<p>The Kore.ai SDK libraries and UI widgets are integrated directly into your client applications, and you will need to generate the JWT from your server.<\/p>\n<ul>\n<li>For the Web SDK, the SDK\u00a0libraries are run from the user\u2019s browser.<\/li>\n<li>For\u00a0mobile SDKs, the SDK\u00a0libraries are run from a user\u2019s mobile phone.<\/li>\n<\/ul>\n<p>You\u00a0need to host the JWT generation as a REST web service for security because the <strong>Client Secret<\/strong> or <strong>RSA Private Key<\/strong> is required for JWT generation and should not be hosted at the client application. You can make the REST web service directly available to SDK libraries or have your application call the JWT generation web service at the backend to make the JWT available to the SDK libraries.<br \/>\nWhen making the JWT generation web service available to the SDK libraries, you should keep the <strong>Client ID<\/strong>, <strong>Client Secret<\/strong>, and any key expiration logic on the server-side and expect only the user ID from the client.<\/p>\n<p>There are several\u00a0open-source libraries available to generate JWT, for example,<\/p>\n<ul>\n<li>NodeJS &#8211; <a href=\"https:\/\/github.com\/auth0\/node-jsonwebtoken\">https:\/\/github.com\/auth0\/node-jsonwebtoken<\/a><\/li>\n<li>Java &#8211; <a href=\"https:\/\/github.com\/auth0\/java-jwt\">https:\/\/github.com\/auth0\/java-jwt<\/a><\/li>\n<li>.Net\u00a0&#8211; <a href=\"https:\/\/github.com\/jwt-dotnet\/jwt\">https:\/\/github.com\/jwt-dotnet\/jwt<\/a><\/li>\n<\/ul>\n<p>To generate credentials for your clients, you must register your client app in the XO Platform tool. For more information, see <a href=\"\/docs\/bots\/advanced-topics\/sdks\/sdk-app-registration\/\">SDK App Registration<\/a>.<\/p>\n<p>You can also try out our tutorial using a Kore.ai sample bot, a test application, and configuring your localhost server for JWT generation. For more information, see the\u00a0<a href=\"\/docs\/bots\/advanced-topics\/sdks\/kore-ai-web-sdk-tutorial\/\">Kore.ai Web SDK Tutorial<\/a>.<\/p>\n\r\n\t\t<\/div>\r\n\t<\/div>\r\n<div class=\"w-separator size_small with_line width_default thick_1 style_solid color_border align_center\"><div class=\"w-separator-h\"><\/div><\/div>\r\n\t<div class=\"wpb_text_column \">\r\n\t\t<div class=\"wpb_wrapper\">\r\n\t\t\t<h2 id=\"JWE\"><span class=\"ez-toc-section\" id=\"JSON_Web_Encryption_JWE\">JSON Web Encryption (JWE)<\/span><\/h2>\n<p><span style=\"font-weight: 400;\">JWT is used to send user identity in a secure form by signing the payload using the Secret Key(HS-256 algorithm) or RSA Private Key(RS-256 algorithm). There can be a requirement to send additional user data along with user identity in JWT using the \u201csecureCustomData\u201d or \u201cprivateClaims\u201d key and make them available in the dialog execution context through the UserContext variable (for example, <\/span><i><span style=\"font-weight: 400;\">context.session.UserContext.privateClaims.accountId<\/span><\/i><span style=\"font-weight: 400;\">). This additional data may be sensitive information. Hence, we need to send it in encrypted form. <\/span><b>JWE (JSON Web Encryption)<\/b><span style=\"font-weight: 400;\"> is an IETF standard that provides a way to send the JWT in an encrypted form.<\/span><\/p>\n<p>A basic implementation involves creating a JWE object, specifying encryption algorithms, and then encrypting the payload.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"About_JWE_Token\">About JWE Token<\/span><\/h3>\n<p>A JWE token is a compact, URL-safe means of representing encrypted content using JSON-based data structures. It enables the secure transmission of encrypted data that can only be decrypted by the intended recipient.<\/p>\n<p>The token contains the following five parts:<\/p>\n<ul>\n<li>Header,<\/li>\n<li>JWE Encrypted Key (CEK),<\/li>\n<li>Initialization Vector,<\/li>\n<li>CipherText, and<\/li>\n<li>Authentication Tag<\/li>\n<\/ul>\n<h4>Header<\/h4>\n<p><span style=\"font-weight: 400;\">The header part can have the following attributes<\/span>:<\/p>\n<ul>\n<li><strong>&#8220;alg&#8221; <\/strong>(Algorithm): defines the algorithm for content key wrapping<br \/>\nFollowing algorithms are supported:<\/li>\n<\/ul>\n<ul>\n<li style=\"list-style-type: none;\">\n<ul>\n<li><em>RSA-OAEP<\/em>,<\/li>\n<li><em>RSA1_5<\/em><\/li>\n<\/ul>\n<\/li>\n<li><strong>&#8220;enc&#8221; <\/strong>(Encryption Algorithm): defines the algorithm for content encryption<br \/>\nFollowing algorithms are supported for content encryption:<\/p>\n<ul>\n<li><em>A128CBC-HS256<\/em><\/li>\n<li><em>A128GCM<\/em><\/li>\n<li><em>A256GCM<\/em><\/li>\n<\/ul>\n<\/li>\n<li><strong>&#8220;kid&#8221; <\/strong>(Key ID): Key Id of Kore Platform\u2019s public key. This will be displayed when you enable the JWE on the XO Platform.<\/li>\n<li><strong>&#8220;typ&#8221;<\/strong> (Token Type): This will have JWT as a value since the wrapped content is JWT.<\/li>\n<\/ul>\n<p>Below is the decoded sample JWE header:<br \/>\n<code>{<br \/>\n\"alg\": \"RSA-OAEP\",<br \/>\n\"enc\": \"A128CBC-HS256\",<br \/>\n\"kid\": \"k-ffb4hty69-750a-44af-91c1-de0bvcf6a\",<br \/>\n\"typ\": \"JWT\"<br \/>\n}<\/code><\/p>\n<h4>JWE Encrypted Key (CEK)<\/h4>\n<p>A symmetric key is generated to encrypt the payload using the algorithm specified in \u201c<em>enc<\/em>\u201d field of the header. This key is encrypted using <em>Kore.ai Public Key<\/em> using the algorithm specified in \u201c<em>alg<\/em>\u201d field of the header.<\/p>\n<h4>Initialization Vector<\/h4>\n<p>This is used in the encryption of the payload (JWT).<\/p>\n<h4>CipherText<\/h4>\n<p>This contains encrypted content of the payload. This is encrypted using the algorithm specified in \u201c<em>enc<\/em>\u201d field of the header using the initialization vector.<\/p>\n<h4>Authentication Tag<\/h4>\n<p>The Authentication tag is generated when authenticated encryption is performed using the algorithm specified in \u201c<em>enc<\/em>\u201d field of the header. This is used during decryption to ensure integrity.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"How_to_Generate_a_JWE_Token\">How to Generate a JWE Token?<\/span><\/h3>\n<p>Generating a JWE token involves the following steps:<\/p>\n<ol>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Choose a JWE Library<\/b><span style=\"font-weight: 400;\">: Choose a programming language and library that supports JWE. There are libraries available for various languages, such as Python (`PyJWT`), Java (`javax.crypto`), Node.js (`node-jose`), etc.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Prepare Your Payload<\/b><span style=\"font-weight: 400;\">: The payload is the data you want to encrypt and include in the JWE token. It can be a JSON object.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Choose Encryption Algorithms<\/b><span style=\"font-weight: 400;\">: Common algorithms include &#8220;RSA-OAEP&#8221; for asymmetric encryption and &#8220;A256GCM&#8221; for symmetric encryption with AES-GCM.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Generate or Obtain Encryption Keys<\/b><span style=\"font-weight: 400;\">: You will need encryption keys depending on the chosen algorithm. For asymmetric encryption, you&#8217;ll need a public key; for symmetric encryption, you&#8217;ll need a shared secret key.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Create the JWE Token<\/b>: Use your JWE library to create the JWE token. Here&#8217;s a Python example using the `PyJWT` library:\n<pre>import jwt\r\n\r\n# Sample payload data you want to include in the JWE token\r\n# Use the \"PrivateClaims\" or \"SecureCustomData\" key to securely pass additional \r\n# data to the Platform\r\npayload = {\r\n    \"sub\": \"1234567890\",\r\n    \"name\": \"John Doe\",\r\n    \"iat\": 1516239022,\r\n    \"privateClaims\": {\r\n      \"accountId\": \"123412512512556\",\r\n      \"fusionSid\": \"12125125125\",\r\n      \"siteId\": \"124125125125\"\r\n    }\r\n}\r\n# Sample encryption key (the shared secret key used for encryption)\r\nsecret_key = \"MySecretKey123\"\r\n# Create the JWE token\r\njwe_token = jwt.encode(\r\n    payload,\r\n    secret_key,\r\n    algorithm='HS256',  # Algorithm for signature (HMAC SHA-256)\r\n    headers={\"alg\": \"A256GCM\"}  # Algorithm for encryption (AES-GCM)\r\n)\r\nprint(\"JWE Token:\", jwe_token)\r\n<\/pre>\n<\/li>\n<\/ol>\n<p><span style=\"font-weight: 400;\">You can now use the generated JWE token in your application.<\/span><\/p>\n<h3><span class=\"ez-toc-section\" id=\"Find_the_Koreai_JWE_Public_Key\">Find the Kore.ai JWE Public Key<\/span><\/h3>\n<p>The <i>Kore.ai Public Key<\/i> is displayed in JWK format when you enable the JWE option while creating an SDK app. You can use this in your client library to generate JWE.<br \/>\n<a ref=\"magnificPopup\" href=\"https:\/\/kore-wordpress.s3.us-east-2.amazonaws.com\/developer.kore.ai\/v10-1\/wp-content\/uploads\/sites\/35\/20231227114718\/jwe-public-key.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-60936\" src=\"https:\/\/kore-wordpress.s3.us-east-2.amazonaws.com\/developer.kore.ai\/v10-1\/wp-content\/uploads\/sites\/35\/20231227114718\/jwe-public-key.png\" alt=\"\" width=\"900\" height=\"413\" srcset=\"https:\/\/kore-wordpress.s3.us-east-2.amazonaws.com\/developer.kore.ai\/v10-1\/wp-content\/uploads\/sites\/35\/20231227114718\/jwe-public-key.png 4389w, https:\/\/kore-wordpress.s3.us-east-2.amazonaws.com\/developer.kore.ai\/v10-1\/wp-content\/uploads\/sites\/35\/20231227114718\/jwe-public-key-300x138.png 300w, https:\/\/kore-wordpress.s3.us-east-2.amazonaws.com\/developer.kore.ai\/v10-1\/wp-content\/uploads\/sites\/35\/20231227114718\/jwe-public-key-1024x470.png 1024w\" sizes=\"auto, (max-width: 900px) 100vw, 900px\" \/><\/a><\/p>\n<h3><span class=\"ez-toc-section\" id=\"Verify_and_Decrypt_the_JWE\"><span style=\"font-weight: 400;\">Verify and Decrypt the JWE<\/span><\/span><\/h3>\n<p><span style=\"font-weight: 400;\">Let\u2019s see an example of how you can verify and decrypt the JWE, assuming you have a JWE token (containing the payload that was encrypted using a private key), and have access to the corresponding JWE public key. The example below is in Python using the \u2018<\/span><span style=\"font-weight: 400;\">PyJWT\u2019<\/span><span style=\"font-weight: 400;\"> library; your implementation may vary depending on the language and the library you\u2019re using.<\/span><\/p>\n<ol>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Import Libraries<\/b><span style=\"font-weight: 400;\">: Ensure you have the necessary libraries installed. In this example, you need `PyJWT` for handling JWTs and JWEs.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Load the Public Key<\/b><span style=\"font-weight: 400;\">: Load the JWE public key in the form of a JSON Web Key (JWK); for example, the <\/span><i><span style=\"font-weight: 400;\">Kore.ai JWE Public Key<\/span><\/i><span style=\"font-weight: 400;\"> as shown in the previous section.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Decode and Verify<\/b><span style=\"font-weight: 400;\">: Use the public key to verify and decrypt the JWE.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Putting it all together<\/b>: Here&#8217;s a Python example using the `PyJWT` library:\n<pre>import jwt\r\n\r\n# Sample JWE token\r\njwe_token = \"eyJhbGciOiJSUzI1NiIs...JWE Ciphertext and other components...UkSIsIm4iOiJqYW1lc3RpY3Nl...\"\r\n\r\n# Sample JWE public key (in JWK format)\r\njwe_public_key = {\r\n      \"e\": \"AQAB\",                 \r\n      \"kid\": \"de668337-....-....-....-5778944f9630\",\r\n      \"kty\": \"RSA\",\r\n      \"n\": \"rdqXc48aW...uNMSdIgn\"\r\n}\r\n\r\ntry:\r\n    decoded_payload = jwt.decode(\r\n        jwe_token,\r\n        jwe_public_key,\r\n        algorithms=['RS256'],  # Algorithm used for signature verification\r\n        options={\"verify_signature\": True, \"decrypt\": True}\r\n    )\r\n    print(\"Decoded Payload:\", decoded_payload)\r\nexcept jwt.ExpiredSignatureError:\r\n    print(\"JWE Signature has expired.\")\r\nexcept jwt.DecodeError:\r\n    print(\"Invalid JWE Signature or Decryption failed.\")\r\n<\/pre>\n<\/li>\n<\/ol>\n<p>In this example code:<\/p>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">\u2018jwe_token` is the JWE that you want to verify and decrypt.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">The `jwt.decode` function is used to decode and verify the JWE.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">The public key is used as the key for signature verification and decryption.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">The `&#8221;verify_signature&#8221;: True` option indicates that the library should verify the signature.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">The `&#8221;decrypt&#8221;: True` option tells the library to attempt decryption of the JWE.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">The `algorithms` parameter specifies the algorithm used for signature verification that should match the algorithm used when creating the JWE.<\/span><\/li>\n<\/ul>\n<p>If the JWE token is valid and the signature can be verified, the payload will be successfully decoded and printed.<\/p>\n<p>For more information about JWE, refer to <a href=\"https:\/\/tools.ietf.org\/html\/rfc7516\">https:\/\/tools.ietf.org\/html\/rfc7516.<\/a><\/p>\n\r\n\t\t<\/div>\r\n\t<\/div>\r\n<div class=\"w-separator size_small with_line width_default thick_1 style_solid color_border align_center\"><div class=\"w-separator-h\"><\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/section>\n","protected":false},"excerpt":{"rendered":"The Kore.ai XO Platform only accepts clients that are authorized to connect and exchange messages. You must register your SDK app with the Kore.ai XO Platform in the XO Platform tool and acquire client credentials. You can then use your client\u00a0credentials to authorize the app and\u00a0communication exchange between your user, bot, and the XO Platform....","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[36],"tags":[],"class_list":["post-17799","post","type-post","status-publish","format-standard","hentry","category-sdks"],"_links":{"self":[{"href":"https:\/\/developer.kore.ai\/v10-1\/wp-json\/wp\/v2\/posts\/17799","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/developer.kore.ai\/v10-1\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/developer.kore.ai\/v10-1\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/developer.kore.ai\/v10-1\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/developer.kore.ai\/v10-1\/wp-json\/wp\/v2\/comments?post=17799"}],"version-history":[{"count":21,"href":"https:\/\/developer.kore.ai\/v10-1\/wp-json\/wp\/v2\/posts\/17799\/revisions"}],"predecessor-version":[{"id":60949,"href":"https:\/\/developer.kore.ai\/v10-1\/wp-json\/wp\/v2\/posts\/17799\/revisions\/60949"}],"wp:attachment":[{"href":"https:\/\/developer.kore.ai\/v10-1\/wp-json\/wp\/v2\/media?parent=17799"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/developer.kore.ai\/v10-1\/wp-json\/wp\/v2\/categories?post=17799"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/developer.kore.ai\/v10-1\/wp-json\/wp\/v2\/tags?post=17799"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}