The token is already validated when it reaches the callback function in auth_controller.ex so you shouldn’t be calling decode_and_verify again in the controller.
The presence of the ueberauth_failure key within conn.assigns indicates that it unsuccessfully ran through the Guardian pipeline whereas the presence of ueberauth_auth indicates that it successfully ran through the Guardian pipeline, including verifying the sesson and header, ensuring authentication, and loading resource.
If you want to access claims["sub"], I suggest you IO.inspect(conn) and it should already be there.
https://github.com/achedeuzot/ueberauth_auth0/blob/de1964785a3d8dc47fba2eb850345f0028b46651/lib/ueberauth/strategy/auth0.ex#L1-L13
https://github.com/achedeuzot/ueberauth_auth0/blob/de1964785a3d8dc47fba2eb850345f0028b46651/lib/ueberauth/strategy/auth0.ex#L193-L198
So since you’re using this ueberauth_auth0 strategy, you should be able to do something like conn.private.auth0_user["sub"].
If you comment out the VerifyHeader plug, it would make sense that a subsequent plug in the pipeline e.g. EnsureAuthenticated might fail with an unauthenticated error.
