# Verifying user identity in an external application using JWTs

**URL:** <https://community.developer.atlassian.com/t/verifying-user-identity-in-an-external-application-using-jwts/64089>\
**Category:** Forge Modules and Product Triggers\
**Tags:** jira-plugin, java, jira-cloud, rest-api, forge, atlassian-connect\
**Created:** [December 6, 2022, 11:23am UTC](https://community.developer.atlassian.com/t/verifying-user-identity-in-an-external-application-using-jwts/64089 "2022-12-06T11:23:08Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![barryservaas](https://avatars.discourse-cdn.com/v4/letter/b/8c91f0/32.png) [@barryservaas](https://community.developer.atlassian.com/u/barryservaas)\
**Post date:** [December 6, 2022, 11:23am UTC](https://community.developer.atlassian.com/t/verifying-user-identity-in-an-external-application-using-jwts/64089/1 "2022-12-06T11:23:08Z")

</div>

Hi there,

I have been trying to make an app on the backend communicate with forge. This works, but since it handles sensitive information, I would also like to verify on the backend that the person making a request to the backend is also really a user of my jira app. After a bit of research, it seems to me that using atlassian-connect is the best way to do so - where on the frontend it will send a json web token (JWT) along with the request, which will be verified on the backend. I have already installed the app in jira and in the backend it now verifies (and rejects) every request sent. Ideally I would also like to be able to see if the user has the right permissions to do this action, but that’s of secondary concern.

My question is then, how do I generate this JWT to be sent along with the request?

Thank you in advance!