> For the complete documentation index, see [llms.txt](https://docs.caf.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.caf.io/caf-docs/user-guide/smart-auth/checking-the-response.md).

# Checking the Response

To ensure the integrity of the results from the Smart Auth SDK, the return information is included in a payload within a JSON Web Token (JWT) signed using your `clientSecret`. This token is called an **attestation** and must be sent to your backend and verified before granting the user access to your system.

In addition to the attestation when isAuthorized is true, which contains the attemptId within the token, there is also a case when isAuthorized is false. In this scenario, the attemptId is returned alongside the isAuthorized field.

Please ensure that both the attestation and attemptId (when applicable) are properly handled and verified in your backend system.

## **How check response without JWT(attestation)**

In cases where the attestation is not present in the response, you will receive an object with two fields: isAuthorized and attemptId.

```javascript
const response = 'response from sdk';
console.log(response);

/* Log:
{
    attemptId: "6018d4da5ea6db000849a669",
    isAuthorized: false
}
*/
```

The attemptId field can be used to capture data about the authentication attempt. For more information, please refer to [here](https://docs.caf.io/caf-api/smart-auth-api/available-resources/authentications).

## **How to get your `clientSecret`**

See [the documentation](/caf-docs/user-guide/smart-auth/access-token.md) about Smart Auth access tokens.

## **JWT validation**

For user validation, we use the returned JWT token.

From it we take data needed for validation (**`isAuthorized`** and **`isNewContext`**).

### **Data entered into JWT(attestation)**

| Field              | Type    | Description                                                                  |
| ------------------ | ------- | ---------------------------------------------------------------------------- |
| **`attemptId`**    | string  | Authentication attempt ID                                                    |
| **`peopleId`**     | string  | Authenticated user CPF                                                       |
| **`policyId`**     | string  | Validated policy ID                                                          |
| **`isAuthorized`** | boolean | Indicates whether the user has been authorized according to the policy rules |
| **`isNewContext`** | boolean | Indicates whether the user context was already known                         |

### **How to extract data from the JWT**

```javascript
import jwt from 'jsonwebtoken';

const attestation = 'attestation received from SDK';
const secret = 'secret of your user';
const attestationData = jwt.verify(attestation, secret);

console.log(attestationData);
/* Log:
{
    attemptId: "6018d4da5ea6db000849a669"
    exp: 1612240210
    iat: 1612240090
    isAuthorized: true
    isNewContext: false
    peopleId: "[cpf]"
    policyId: "[policy id]"
}
*/
```

### **Authorization check**

<pre class="language-javascript"><code class="lang-javascript">const { isAuthorized, isNewContext } = attestationData;

if(isAuthorized &#x26;&#x26; !isNewContext) {
<strong>    // authorized user with no verification required
</strong>} else if(isAuthorized &#x26;&#x26; isNewContext) {
    // authorized user after verification
}
</code></pre>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.caf.io/caf-docs/user-guide/smart-auth/checking-the-response.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.