How do I verify a session on my backend?

Your frontend sends the session token with each request; your backend verifies it. With a backend SDK it's one call. In Go:

session, err := atlas.Authenticate(r)
if err != nil {
    http.Error(w, "unauthorized", http.StatusUnauthorized)
    return
}
userID := session.User.ID
orgID := session.OrgID

The SDK verifies the token cryptographically against Atlas's signed JWKS (cached, so it's fast and works offline of the API), checks expiry and rotation, and gives you the user, active organization and permissions. The same helper exists in Node, Python, Ruby, PHP, Java and .NET.

If you're verifying JWTs manually (no SDK), fetch the JWKS from your instance's well-known endpoint and validate the signature, iss, aud and exp. See the backend guide.