Update new URL and method for backend verification

[yashovardhan]

Fix missing issuer and audience validation in JWKS-based JWT verification examples across the Embedded Wallets documentation. Without these checks, a token signed by Web3Auth for any other project passes signature verification, enabling cross-project token reuse against backends that identify users by userId, email, or authConnectionId.

---

Note

Low Risk
Low risk documentation-only change, but it affects security guidance; incorrect copy/paste could lead to broken verification or continued cross-project token acceptance.

Overview
Updates Embedded Wallets docs to require issuer + audience validation in all JWKS-based JWT verification examples (both jose and jsonwebtoken), and adds an explicit warning explaining the cross-project token reuse risk when aud is not checked.

Standardizes token/JWKS endpoints and claims across guides (e.g., uses https://api-auth.web3auth.io/jwks and correct iss values for social vs external wallets) and refreshes troubleshooting guidance accordingly.

^{Reviewed by Cursor Bugbot for commit 1a31bf8. Bugbot is set up for automated code reviews on this repo. Configure here.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
metamask-docs	Ready	Preview, Comment	Apr 30, 2026 8:24am