# Verification of ApplicationID in JWT

**URL:** <https://forum.canton.network/t/verification-of-applicationid-in-jwt/209>\
**Category:** App Development\
**Tags:** api, daml-sdk\
**Created:** [April 23, 2020, 3:23am UTC](https://forum.canton.network/t/verification-of-applicationid-in-jwt/209 "2020-04-23T03:23:08Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Piyush\_Bedi](https://yyz2.discourse-cdn.com/flex034/user_avatar/forum.canton.network/piyush_bedi/32/113_2.png) [@Piyush\_Bedi](https://forum.canton.network/u/Piyush_Bedi)\
**Post date:** [April 23, 2020, 3:23am UTC](https://forum.canton.network/t/verification-of-applicationid-in-jwt/209/1 "2020-04-23T03:23:08Z")

</div>

Does the AuthService bundled with the SDK validate the ApplicationID in the JWT against the ApplicationID supplied in the LedgerAPI Command?

The Authorizer seems to ignore it: [https://github.com/digital-asset/daml/blob/878429e3bf07b09e727224d5dc423444d071a95b/ledger/ledger-api-auth/src/main/scala/com/digitalasset/ledger/api/auth/Authorizer.scala#L29](https://github.com/digital-asset/daml/blob/878429e3bf07b09e727224d5dc423444d071a95b/ledger/ledger-api-auth/src/main/scala/com/digitalasset/ledger/api/auth/Authorizer.scala#L29)

---

<div class="post-metadata">

**Author:** ![stefanobaghino-da](https://yyz2.discourse-cdn.com/flex034/user_avatar/forum.canton.network/stefanobaghino-da/32/7057_2.png) [@stefanobaghino-da](https://forum.canton.network/u/stefanobaghino-da)\
**Post date:** [April 23, 2020, 8:08am UTC](https://forum.canton.network/t/verification-of-applicationid-in-jwt/209/2 "2020-04-23T08:08:55Z")

</div>

You are absolutely right, this is a bug. Thanks to @Robert_Autenrieth for looking into this.

I’m opening a ticket to track this.

---

<div class="post-metadata">

**Author:** ![stefanobaghino-da](https://yyz2.discourse-cdn.com/flex034/user_avatar/forum.canton.network/stefanobaghino-da/32/7057_2.png) [@stefanobaghino-da](https://forum.canton.network/u/stefanobaghino-da)\
**Post date:** [April 23, 2020, 8:12am UTC](https://forum.canton.network/t/verification-of-applicationid-in-jwt/209/3 "2020-04-23T08:12:02Z")

</div>

Tracked by [Authorization ignores the application identifier in the token · Issue #5683 · digital-asset/daml · GitHub](https://github.com/digital-asset/daml/issues/5683).

Thanks for raising this.