Passes and verification
Waitrooms passes are ES256 JWTs. Verify them offline with our JWKS and honor revocations.
A pass is a JSON Web Token signed with ES256. Public keys are published at:
https://api.waitrooms.dev/.well-known/jwks.jsonClaims
| Claim | Meaning |
|---|---|
aud | Room ID. Always check it matches your room. |
exp | Expiry: issue time plus the room's session length. |
ep | Room epoch when issued. Lower than the room's current epoch means revoked by an emergency. |
via | queue, direct, vip, rule or failopen. |
rid, tkt, sub | Room, ticket and an opaque visitor ID. |
Where to find it
After the waiting page, visitors arrive with ?wr_pass=… in the URL. The SDKs move it into the cookie wr_pass_<room> (any character other than letters and digits in the room ID becomes _).
Revocation
To honor the emergency control, compare ep to the room's current epoch from GET /v1/q/<room>/state (cache it for a few seconds). Our SDKs do this for you. Or ask us: POST /v1/pass/verify with { "pass": "…", "room": "your-room" }.
Something unclear? Email hello@waitrooms.dev.