@askrjs/auth/jwt

AskrJsonWebKeytype

AskrJsonWebKey: any

JSON Web Key with the metadata used by Askr token validation.

kid

Key identifier advertised by the issuer.

alg

JOSE algorithm identifier.

use

Intended key use, such as signing.

createJwtIssuertype

createJwtIssuer: (options: JwtIssuerOptions) => JwtIssuer

Create an issuer that signs and validates its own JWTs.

createJwtSignertype

createJwtSigner: (options: JwtSignerOptions) => JwtSigner

Create a signer that enforces Askr-owned JWT headers.

createJwtValidatortype

createJwtValidator: (options: JwtValidatorOptions) => JwtValidator

Create a JWT validator with issuer, audience, key-refresh, and clock policy.

issueTimedJwttype

issueTimedJwt: (signer: JwtSigner, input: TimedJwtInput) => Promise<string>

Issue a JWT with validated time, issuer, subject, and audience claims.

JsonWebKeySettype

JsonWebKeySet: any

Set of public keys used to validate JWT signatures.

keys

Public keys indexed by their JOSE metadata.

JwksProvidertype

JwksProvider: JsonWebKeySet | (() => JsonWebKeySet | PromiseLike<JsonWebKeySet>)

Static or asynchronously refreshed JSON Web Key provider.

JwtIssueInputtype

JwtIssueInput: any

Principal claims and subject used to issue a JWT.

subject

Subject claim to encode.

JwtIssuertype

JwtIssuer: any

JWT issuer and its matching validator.

issue

Issue a compact JWT.

validator

Validator configured with this issuer's public-key policy.

JwtIssuerOptionstype

JwtIssuerOptions: any

Configuration for issuing signed JWTs.

privateKey

Private signing key.

kid

JOSE key identifier.

issuer

Issuer claim.

audience

Audience claim or claims.

ttlSeconds

Token lifetime in seconds.

clock

Clock returning Unix time in seconds.

JwtSignertype

JwtSigner: any

Signs JWT payloads with a configured private key.

sign

Sign claims with the configured key.

JwtSignerOptionstype

JwtSignerOptions: any

Private-key configuration for a JWT signer.

privateKey

Private signing key in Web Crypto JWK form.

kid

JOSE key identifier included in protected headers.

JwtSignInputtype

JwtSignInput: any

Claims and optional protected headers for one JWT.

claims

Payload claims to encode.

protectedHeader

Additional protected headers; `alg` and `kid` are managed by Askr.

JwtValidationErrortype

JwtValidationError: typeof JwtValidationError

Error raised when a JWT cannot be validated.

code

Error category used for programmatic handling.

JwtValidationErrorCodetype

JwtValidationErrorCode: "malformed_token" | "unsupported_algorithm" | "unknown_key" | "invalid_signature" | "invalid_claim"

Stable failure codes returned by JWT validation.

JwtValidatortype

JwtValidator: any

Verifies a JWT and returns its typed principal claims.

validate

Validate a compact JWT.

JwtValidatorOptionstype

JwtValidatorOptions: any

Validation policy for signed JWTs.

issuer

Expected issuer claim.

audience

Expected audience claim or accepted audience values.

jwks

Public keys used to verify signatures.

clock

Clock returning Unix time in seconds.

clockSkewSeconds

Allowed clock skew in seconds.

typ

Require a protected typ value and restrict it to these values.

requireTyp

Require a non-empty protected typ value without restricting its value.

jwksRefreshCooldownSeconds

Minimum interval between refreshes after an unknown key.

unknownKeyCacheSeconds

Duration for caching unknown-key failures.

OidcIdTokenOptionstype

OidcIdTokenOptions: any

OIDC-specific JWT validation options.

nonce

Expected OIDC nonce claim.

TimedJwtInputtype

TimedJwtInput: any

Standard claims used to issue a short-lived JWT.

issuer

Issuer claim.

subject

Subject claim.

audience

Audience claim or claims.

ttlSeconds

Lifetime in seconds.

typ

Protected JOSE type header.

claims

Additional application claims.

clock

Clock returning Unix time in seconds.

validateOidcIdTokentype

validateOidcIdToken: (token: string, options: OidcIdTokenOptions) => Promise<Principal>

Validate an OIDC ID token, including its nonce claim.