quantum-safe-ts

Appearance

Class: JWTSigner ​

Defined in: jwt.ts:172

Signs quantum-safe-py-compatible JWTs. See the module notes: other JOSE libraries cannot verify them.

The header is { alg, typ: "JWT", "qs-version": 1 } with alg the key's algorithm name; the payload is built from the claims you pass plus iss, iat and exp. The signature part is base64url of the signature blob over header.payload.

Example ​

ts
using pair = new Sign('ML-DSA-65').generateKeyPair();
const token = new JWTSigner(pair, { issuer: 'auth.example' }).sign({ sub: 'alice' }, { expiresIn: 600 });
const claims = new JWTVerifier(pair.publicKey, { issuer: 'auth.example' }).verify(token);

Constructors ​

Constructor ​

new JWTSigner(key, options?): JWTSigner

Defined in: jwt.ts:186

Creates a signer for key, using a hybrid signer when the algorithm name contains + and a single-algorithm signer otherwise.

Parameters ​

key ​

SecretKey | KeyPair

The secret key, or a key pair whose secret key is used.

options? ​

JwtSignerOptions = {}

Issuer and hedging. Hedged signing is on by default.

Returns ​

JWTSigner

Throws ​

if key is not a SecretKey or KeyPair.

Throws ​

if the key's algorithm is not a supported signature algorithm.

Properties ​

algorithm ​

readonly algorithm: SignatureAlgorithm

Defined in: jwt.ts:174

The signature algorithm of the key; it is written to the header alg.

Methods ​

sign() ​

sign(claims?, options?): string

Defined in: jwt.ts:205

Signs claims and returns header.payload.signature.

Parameters ​

claims? ​

JwtClaims = {}

Claims to include; they override the generated iss, iat and exp.

options? ​

JwtSignOptions = {}

expiresIn in seconds (default 3600; 0 omits exp) and the signing context (default the bytes of "jwt").

Returns ​

string

The compact token.

Throws ​

if expiresIn is negative or not finite, or context is longer than 255 bytes.

Throws ​

if the underlying signing operation fails.

Apache-2.0.