`maqpna token verify`

Verify a session token's signature and claims against a JWKS

Synopsis#

maqpna token verify TOKEN --jwks URL|FILE [--audience maqpna-gateway] [--issuer ISS]   (exit 3 when invalid)

Flag	Type	Description	Default
`--audience`	string	required audience (e.g. maqpna-gateway)	none
`--issuer`	string	required issuer	none
`--jwks`	string	JWKS URL (https://.../.well-known/jwks.json) or file	none

The global flags (--context, -o, --no-color, ...) work with every command.

$ maqpna token verify "$TOKEN" --jwks http://127.0.0.1:8081/.well-known/jwks.json

Prints a table by default; -o json or -o yaml print the data, and --jq EXPR filters the JSON.
Exits 3 when the check fails or a result does not match (see exit codes below), so scripts and CI can act on it.

Code	Meaning
`0`	success
`1`	error (the message says what failed, with a hint when there is one)
`2`	usage error: unknown flag, missing argument or bad value; the synopsis is printed
`3`	a check failed, a change is blocked, or a result did not match (tamper, policy mismatch)

maqpna token verify.cast