We are going to be passing in a JWT to our bot on conversation start, we need to verify that JWT within the bot to make sure the user that starts the conversation is permitted to access the bot. We first thought we could easily implement JWT verification within an Execute Code card. However, as external libraries can't be imported this becomes very painful. We would want to use the jwks-rsa and jsonwebtoken libraries (or similar equivalents), but it seems this isn't possible in an execute code card? We then discovered a third-party botpress integration called JSON Web Token (written by simplygreatbots) which promises to be able to verify JWTs. After installing it seems this can only verify symmetric HS256 keys that use a shared secret, and not the superior asymmetric RS256 variant that use a public certificate (in our case Auth0's). I'm wondering if anyone has any experience of getting this kind of thing to work within a bot? Is there not a standard recommended way of achieving this without using a third-party integration (or even building our own)?

I will tag @straight-wolf-37371

the webCrypto library is available in execute code cards. if that helps