title: How to verify firebase ID token with PHP(JWT)?
body: <p>I have a shared hosting plan which has only PHP(no Java, no node.js). I need to send firebase ID token from my android app and verify it by PHP-JWT.</p>
  <p>I am following the tutorial: <a href="https://firebase.google.com/docs/auth/admin/verify-id-tokens" rel="nofollow noreferrer">Verify Firebase ID tokens</a></p>
  <p>It says:</p>
  <blockquote>
  <p>If your backend is in a language that doesn't have an official
  Firebase Admin SDK, you can still verify ID tokens. First, find a
  third-party JWT library for your language. Then, verify the header,
  payload, and signature of the ID token.</p>
  </blockquote>
  <p>I found that library: <a href="https://github.com/firebase/php-jwt" rel="nofollow noreferrer">Firebase-PHP-JWT</a>. In gitHub example; i couldn't understand the</p>
  <p>$key part:</p>
  <pre><code>`$key = &quot;example_key&quot;;` 
  </code></pre>
  <p>and</p>
  <p>$token part:</p>
  <pre><code>`$token = array(
      &quot;iss&quot; =&gt; &quot;http://example.org&quot;,
      &quot;aud&quot; =&gt; &quot;http://example.com&quot;,
      &quot;iat&quot; =&gt; 1356999524,
      &quot;nbf&quot; =&gt; 1357000000
  );`
  </code></pre>
  <p>My questions:</p>
  <ol>
  <li>What should be the <strong>$key</strong> variable?</li>
  <li>Why the <strong>&amp;token</strong> variable is an array? Token which will be sent from mobile app is a String.</li>
  <li>If somebody could post a full example of verifying firebase ID with PHP-JWT, i would appreciate it.</li>
  </ol>
  <p><strong>EDIT:</strong></p>
  <p>Okey i got the point. GitHub example shows how to generate JWT code(encode) and how to decode it. In my case i need only decode the jwt which encoded by firebase. So, i need to use only this code:</p>
  <pre><code>$decoded = JWT::decode($jwt, $key, array('HS256'));
  </code></pre>
  <p>In this code part <strong>$jwt</strong> is the firebase ID token. For <strong>$key</strong> variable documentation says:</p>
  <blockquote>
  <p>Finally, ensure that the ID token was signed by the private key corresponding to the token's kid claim. Grab the public key from <a href="https://www.googleapis.com/robot/v1/metadata/x509/securetoken@system.gserviceaccount.com" rel="nofollow noreferrer">https://www.googleapis.com/robot/v1/metadata/x509/securetoken@system.gserviceaccount.com</a> and use a JWT library to verify the signature. Use the value of max-age in the Cache-Control header of the response from that endpoint to know when to refresh the public keys.</p>
  </blockquote>
  <p><em><strong>I didn't understand how to pass this public keys to decode function. Keys are something like this:</strong></em></p>
  <blockquote>
  <p>&quot;-----BEGIN CERTIFICATE-----\nMIIDHDCCAgSgAwIBAgIIZ36AHgMyvnQwDQYJKoZIhvcNAQEFBQAwMTEvMC0GA1UE\nAxMmc2VjdXJldG9rZW4uc3lzdGVtLmdzZXJ2aWNlYWNjb3VudC5jb20wHhcNMTcw\nMjA4MDA0NTI2WhcNMTcwMjExMDExNTI2WjAxMS8wLQYDVQQDEyZzZWN1cmV0b2tl\nbi5zeXN0ZW0uZ3NlcnZpY2VhY2NvdW50LmNvbTCCASIwDQYJKoZIhvcNAQEBBQAD\nggEPADCCAQoCggEBANBNTpiQplOYizNeLbs+r941T392wiuMWr1gSJEVykFyj7fe\nCCIhS/zrmG9jxVMK905KwceO/FNB4SK+l8GYLb559xZeJ6MFJ7QmRfL7Fjkq7GHS\n0/sOFpjX7vfKjxH5oT65Fb1+Hb4RzdoAjx0zRHkDIHIMiRzV0nYleplqLJXOAc6E\n5HQros8iLdf+ASdqaN0hS0nU5aa/cPu/EHQwfbEgYraZLyn5NtH8SPKIwZIeM7Fr\nnh+SS7JSadsqifrUBRtb//fueZ/FYlWqHEppsuIkbtaQmTjRycg35qpVSEACHkKc\nW05rRsSvz7q1Hucw6Kx/dNBBbkyHrR4Mc/wg31kCAwEAAaM4MDYwDAYDVR0TAQH/\nBAIwADAOBgNVHQ8BAf8EBAMCB4AwFgYDVR0lAQH/BAwwCgYIKwYBBQUHAwIwDQYJ\nKoZIhvcNAQEFBQADggEBAEuYEtvmZ4uReMQhE3P0iI4wkB36kWBe1mZZAwLA5A+U\niEODMVKaaCGqZXrJTRhvEa20KRFrfuGQO7U3FgOMyWmX3drl40cNZNb3Ry8rsuVi\nR1dxy6HpC39zba/DsgL07enZPMDksLRNv0dVZ/X/wMrTLrwwrglpCBYUlxGT9RrU\nf8nAwLr1E4EpXxOVDXAX8bNBl3TCb2fu6DT62ZSmlJV40K+wTRUlCqIewzJ0wMt6\nO8+6kVdgZH4iKLi8gVjdcFfNsEpbOBoZqjipJ63l4A3mfxOkma0d2XgKR12KAfYX\ncAVPgihAPoNoUPJK0Nj+CmvNlUBXCrl9TtqGjK7AKi8=\n-----END CERTIFICATE-----\n&quot;</p>
  </blockquote>
  <p>Do i need to convert this public key to something before pass it? I tried to remove all <strong>&quot;\n&quot;</strong> and <strong>&quot;-----BEGIN CERTIFICATE-----&quot;</strong>, <strong>&quot;-----BEGIN CERTIFICATE-----&quot;</strong>...But no luck. Still i get invalid signature error. Any advice?</p>