Update new URL and method for backend verification

[yashovardhan]

Fix missing issuer and audience validation in JWKS-based JWT verification examples across the Embedded Wallets documentation. Without these checks, a token signed by Web3Auth for any other project passes signature verification, enabling cross-project token reuse against backends that identify users by userId, email, or authConnectionId.

---

Note

Low Risk
Low risk documentation-only change, but it updates security-critical guidance; incorrect values could cause token verification failures or misconfiguration if not reviewed carefully.

Overview
Updates Embedded Wallets docs to require issuer and audience validation in all JWKS-based JWT verification examples, and explains the cross-project token reuse risk when aud is not checked.

Refreshes examples and troubleshooting to use the correct endpoints/issuers (e.g., https://api-auth.web3auth.io/jwks for social logins and https://authjs.web3auth.io/jwks for external wallets), and aligns jsonwebtoken/jose snippets to pass algorithms: ['ES256'], issuer, and audience consistently.

^{Reviewed by Cursor Bugbot for commit 86d91b2. Bugbot is set up for automated code reviews on this repo. Configure here.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
metamask-docs	Ready	Preview, Comment	May 10, 2026 8:36am