Decode JSON Web Token in CF2025.

Report · Jan 14, 2026

I'm working on building an interface with ID.me. I am currently getting back a valid JWT from the ID.me API (it successfully decodes using JWT.IO) but I'm having trouble decoding it in ColdFusion. The CF function VerifySignedJWT has three required parameters and, I believe, I am having trouble with the second parameter signOptions. The CF documentation indicates this parameter should be a strcut containing the key, KeyPair, JWK-JSON Web Keyset URL or file or string, Keystore file, keystore password, keystore alias.

I am retrieveing the key array from the JWK-JSON Web Keyset URL (ID.me's well known endpoint) but am stuck here. When I attempt to decode using
        <cftry>
            <cfset payload = VerifySignedJWT(idToken, key, c)>
            <cfcatch type="any">
                <cfdump var = '#cfcatch#'>
                <cfabort>
            </cfcatch>
        </cftry>
where ‘key’ is the RS256 key struct from the key array returned from the well-known endpoint.

I am getting the exception

struct

Detail	Either the keystore path is invalid or corrupt or the keystore password is wrong.
Message	Error in loading keystore.
StackTrace	coldfusion.util.KeystoreUtils$InvalidKeystoreException: Error in loading keystore. at coldfusion.util.KeystoreUtils.getKeyPair(KeystoreUtils.java:93) at coldfusion.jwt.StandardJwtProvider.verifySignedJwt(StandardJwtProvider.java:148) at coldfusion.runtime.CFPage.VerifySignedJWT(CFPage.java:18615) at cfidme2ecfc1636214689$funcDECODEIDTOKEN.runFunction(……

I have tried using the well-known enpoint URL, the full struct of keys (httpResult) returned from the well-known endpoint, just the RS256 key struct contained withing the httpResult array of keys. I keep getting the same error.

I can decode the token returned from the API at JWT.IO and I can validate the token, using the key returned from the well-known endpoint, at JWT.IO.

What am I missing?
Thanks!

Report · Jan 15, 2026

I don't think you are missing anything. My guess is that VerifySignedJWT() in ColdFusion 2025 does not support remote JWKS URLs. So, when you retrieve the key from the JWK-JSON Web Keyset URL

https://api.idmelabs.com/oidc/.well-known/jwks

ColdFusion treats that as a keystore reference, not as a JWKS endpoint. As a result, ColdFusion tries to load it as a Java keystore file. That would explain why you get: "Either the keystore path is invalid or corrupt or the keystore password is wrong".

Report · Jan 16, 2026

Looking into the issue some more, my initial thoughts have been confirmed. You get "Error in loading keystore" because the way the keys are exposed in ID.me is different from the way ColdFusion handles them.

ID.me uses OIDC / OAuth2, which means:

Tokens are signed with rotating public keys;
Public keys are exposed via JWKS (JSON Web Key Set) over HTTPS.

Whereas, ColdFusion’s built-in JWT functions (VerifySignedJWT, SignJWT) were designed for:

Static keystores (JKS / PKCS12);
Local key material on the ColdFusion server;
Enterprise/internal JWT use.