This page is for admins who make Buttons.

A Link button with a [Signed link](/docs/buttons/link-button/sections/signed-link) adds a token to the URL. The token
tells the target page which Pipedrive user clicked the Button. In this guide, you verify the token on a Node.js
server.

You need:

- A Link button with a Signed link.
- The signing secret of the Button.
- Node.js 18 or later on your server.

## Verify the token with the crypto module

This function uses only the built-in `crypto` module. It returns the claims of a valid token, or `null`. The code
uses `import` and `export`, so set `"type": "module"` in `package.json` or use a `.mjs` file.

```js
import { createHmac, timingSafeEqual } from 'node:crypto';

export function verifyOneClickToken(token, secret) {
	const [header, payload, signature] = token.split('.');
	if (!header || !payload || !signature) return null;
	const { alg } = JSON.parse(Buffer.from(header, 'base64url').toString());
	if (alg !== 'HS256') return null;
	const key = Buffer.from(secret, 'base64url');
	const expected = createHmac('sha256', key).update(`${header}.${payload}`).digest();
	const actual = Buffer.from(signature, 'base64url');
	if (actual.length !== expected.length || !timingSafeEqual(actual, expected)) return null;
	const claims = JSON.parse(Buffer.from(payload, 'base64url').toString());
	if (claims.exp <= Math.floor(Date.now() / 1000)) return null;
	return claims;
}
```

The function does the steps in
[Verify the token on the target page](/docs/buttons/link-button/sections/signed-link#verify-the-token-on-the-target-page).
It uses the decoded bytes of the secret as the key, not the text of the secret.

## Verify the token with a JWT library

With a JWT library, give the decoded bytes of the secret as the key. For example, with `jsonwebtoken`:

```js
jwt.verify(token, Buffer.from(secret, 'base64url'), { algorithms: ['HS256'] });
```

## Use the claims

The claims tell the Pipedrive company and the Pipedrive user. For the list of the claims, see
[Verify the token on the target page](/docs/buttons/link-button/sections/signed-link#verify-the-token-on-the-target-page).

Do not use the other values in the URL for access control, for example the ID of the deal. The token does not sign
them.