# @askrjs/auth/jwt

> Published API exports for @askrjs/auth/jwt.

Source: [https://askrjs.com/docs/reference/api/auth/jwt](https://askrjs.com/docs/reference/api/auth/jwt)

Status: stable. Packages: @askrjs/auth/jwt.

**Published packages are authoritative.** Examples may lag behind a published contract. When guidance differs, verify the exports and TypeScript declarations in your installed package, then file an issue.

## Exports

This entrypoint publishes 20 exports from the declarations shipped by @askrjs/auth.

### `AskrJsonWebKey`

```ts
AskrJsonWebKey: any
```

JSON Web Key with the metadata used by Askr token validation.

- `kid`: Key identifier advertised by the issuer.

- `alg`: JOSE algorithm identifier.

- `use`: Intended key use, such as signing.

### `createJwtIssuer`

```ts
createJwtIssuer: (options: JwtIssuerOptions) => JwtIssuer
```

Create an issuer that signs and validates its own JWTs.

### `createJwtSigner`

```ts
createJwtSigner: (options: JwtSignerOptions) => JwtSigner
```

Create a signer that enforces Askr-owned JWT headers.

### `createJwtValidator`

```ts
createJwtValidator: (options: JwtValidatorOptions) => JwtValidator
```

Create a JWT validator with issuer, audience, key-refresh, and clock policy.

### `issueTimedJwt`

```ts
issueTimedJwt: (signer: JwtSigner, input: TimedJwtInput) => Promise<string>
```

Issue a JWT with validated time, issuer, subject, and audience claims.

### `JsonWebKeySet`

```ts
JsonWebKeySet: any
```

Set of public keys used to validate JWT signatures.

- `keys`: Public keys indexed by their JOSE metadata.

### `JwksProvider`

```ts
JwksProvider: JsonWebKeySet | (() => JsonWebKeySet | PromiseLike<JsonWebKeySet>)
```

Static or asynchronously refreshed JSON Web Key provider.

### `JwtIssueInput`

```ts
JwtIssueInput: any
```

Principal claims and subject used to issue a JWT.

- `subject`: Subject claim to encode.

### `JwtIssuer`

```ts
JwtIssuer: any
```

JWT issuer and its matching validator.

- `issue`: Issue a compact JWT.

- `validator`: Validator configured with this issuer's public-key policy.

### `JwtIssuerOptions`

```ts
JwtIssuerOptions: any
```

Configuration for issuing signed JWTs.

- `privateKey`: Private signing key.

- `kid`: JOSE key identifier.

- `issuer`: Issuer claim.

- `audience`: Audience claim or claims.

- `ttlSeconds`: Token lifetime in seconds.

- `clock`: Clock returning Unix time in seconds.

### `JwtSigner`

```ts
JwtSigner: any
```

Signs JWT payloads with a configured private key.

- `sign`: Sign claims with the configured key.

### `JwtSignerOptions`

```ts
JwtSignerOptions: any
```

Private-key configuration for a JWT signer.

- `privateKey`: Private signing key in Web Crypto JWK form.

- `kid`: JOSE key identifier included in protected headers.

### `JwtSignInput`

```ts
JwtSignInput: any
```

Claims and optional protected headers for one JWT.

- `claims`: Payload claims to encode.

- `protectedHeader`: Additional protected headers; `alg` and `kid` are managed by Askr.

### `JwtValidationError`

```ts
JwtValidationError: typeof JwtValidationError
```

Error raised when a JWT cannot be validated.

- `code`: Error category used for programmatic handling.

### `JwtValidationErrorCode`

```ts
JwtValidationErrorCode: "malformed_token" | "unsupported_algorithm" | "unknown_key" | "invalid_signature" | "invalid_claim"
```

Stable failure codes returned by JWT validation.

### `JwtValidator`

```ts
JwtValidator: any
```

Verifies a JWT and returns its typed principal claims.

- `validate`: Validate a compact JWT.

### `JwtValidatorOptions`

```ts
JwtValidatorOptions: any
```

Validation policy for signed JWTs.

- `issuer`: Expected issuer claim.

- `audience`: Expected audience claim or accepted audience values.

- `jwks`: Public keys used to verify signatures.

- `clock`: Clock returning Unix time in seconds.

- `clockSkewSeconds`: Allowed clock skew in seconds.

- `typ`: Require a protected typ value and restrict it to these values.

- `requireTyp`: Require a non-empty protected typ value without restricting its value.

- `jwksRefreshCooldownSeconds`: Minimum interval between refreshes after an unknown key.

- `unknownKeyCacheSeconds`: Duration for caching unknown-key failures.

### `OidcIdTokenOptions`

```ts
OidcIdTokenOptions: any
```

OIDC-specific JWT validation options.

- `nonce`: Expected OIDC nonce claim.

### `TimedJwtInput`

```ts
TimedJwtInput: any
```

Standard claims used to issue a short-lived JWT.

- `issuer`: Issuer claim.

- `subject`: Subject claim.

- `audience`: Audience claim or claims.

- `ttlSeconds`: Lifetime in seconds.

- `typ`: Protected JOSE type header.

- `claims`: Additional application claims.

- `clock`: Clock returning Unix time in seconds.

### `validateOidcIdToken`

```ts
validateOidcIdToken: (token: string, options: OidcIdTokenOptions) => Promise<Principal>
```

Validate an OIDC ID token, including its nonce claim.

## Documentation navigation

[Previous](https://askrjs.com/docs/reference/api/auth/root/index.md) | [Next](https://askrjs.com/docs/reference/api/auth/oidc/index.md)