<!-- llms.txt: https://workos.com/llms.txt -->

# Session tokens

## Access token

The access token that is returned in successful authentication responses is a JWT that can be used to verify that a user has an active session. The JWT is signed by a JWKS which can be retrieved from the [WorkOS API](https://workos.com/docs/reference/authkit/session-tokens/jwks).

:::code-group{title="Decoded access token"}

```json language="json"
{
  "iss": "https://api.workos.com",
  "sub": "user_01HBEQKA6K4QJAS93VPE39W1JT",
  "client_id": "client_123456789",
  "act": {
    "sub": "admin@foocorp.com"
  },
  "org_id": "org_01HRDMC6CM357W30QMHMQ96Q0S",
  "role": "member",
  "roles": ["member"],
  "permissions": ["posts:read", "posts:write"],
  "entitlements": ["audit-logs"],
  "feature_flags": ["advanced-analytics"],
  "sid": "session_01HQSXZGF8FHF7A9ZZFCW4387R",
  "jti": "01HQSXZXPPFPKMDD32RKTFY6PV",
  "exp": 1709193857,
  "iat": 1709193557
}
```

:::

## JWKS URL

This hosts the public key that is used for verifying access tokens.

:::code-group

```bash language="curl" title="Request" tab="1"

curl https://api.workos.com/sso/jwks/client_123456789
```

```js language="js" title="Request" tab="1"
import { WorkOS } from '@workos-inc/node';

const workos = new WorkOS('sk_test_123');

const jwksUrl = workos.userManagement.getJwksUrl('client_123456789');
```

```rb language="ruby" title="Request" tab="1"
require "workos"

WorkOS.configure do |config|
  config.key = "sk_example_123456789"
end

jwks_url = WorkOS::UserManagement.get_jwks_url("client_123456789")
```

```py language="python" title="Request" tab="1"
from workos import WorkOSClient

workos_client = WorkOSClient(
    api_key="sk_example_123456789", client_id="client_123456789"
)

jwks_url = workos_client.user_management.get_jwks_url()
```

```go language="go" title="Request" tab="1"
package main

import (
	"github.com/workos/workos-go/v2/pkg/usermanagement"
)

func main() {
	usermanagement.SetAPIKey(
		"sk_example_123456789",
	)

	jwksUrl, err := usermanagement.GetJWKSURL("client_123456789")
}
```

```php language="php" title="Request" tab="1"
<?php

WorkOS\WorkOS::setApiKey("sk_example_123456789");

$userManagement = new WorkOS\UserManagement();

$jwksUrl = $userManagement->getJwksUrl("client_123456789");
```

```java language="java" title="Request" tab="1"
import com.workos.WorkOS;

WorkOS workos = new WorkOS("sk_example_123456789");

String jwksUrl = workos.userManagement.getJwksUrl("client_123456789");
```

```txt language="url" title="Response" tab="2"
https://api.workos.com/sso/jwks/client_123456789
```

:::

## Refresh token

The refresh token can be used to obtain a new access token using the [authenticate with refresh token
](https://workos.com/docs/reference/authkit/authentication/refresh-token) endpoint. Refresh tokens may only be used once. Refreshes will succeed as long as the user's session is still active.

### GET /sso/jwks

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `clientId` | string | Yes | client_id |

#### Returns

| Field | Type | Description |
| --- | --- | --- |
| `url` | string | URL that hosts the JWKS for signing access tokens. |