Decode a NextAuth.js JWE token

decode-example.ts

import { jwtDecrypt } from 'jose'
import { hkdf } from '@panva/hkdf'

/**
 * Derive the encryption key the same way NextAuth does
 */
async function getDerivedEncryptionKey(keyMaterial: string | Buffer, salt: string) {
  return await hkdf(
    'sha256',
    keyMaterial,
    salt,
    `NextAuth.js Generated Encryption Key${salt ? ` (${salt})` : ''}`,
    32,
  )
}

/**
 * Decode a NextAuth.js JWE token
 */
async function decodeNextAuthToken(token: string, secret: string) {
  const encryptionSecret = await getDerivedEncryptionKey(secret, '')
  const { payload } = await jwtDecrypt(token, encryptionSecret, {
    clockTolerance: 15,
  })
  return payload
}

const token = process.env.PAYLOAD_JWE_SECRET || ''
const secret = process.env.PAYLOAD_SECRET || ''
const payload = await decodeNextAuthToken(token, secret)