We validate it against the secret you provide when setting up the Auth0 Auth Provider. Would you mind creating a feature request for this? https://github.com/graphcool/feature-requests/issues