zerojwt

Oct 20, 2026

Changes in this version

+ var ErrSigningFailed = errors.New("zerojwt: cryptographic signing failed")

type Options

+ func SecureOptions() Options

type Verifier

+ func NewSecureVerifier(secret []byte) (*Verifier, error)

+ func NewSecureVerifierWithOptions(secret []byte, opts Options) (*Verifier, error)

+ func (v *Verifier) TrySign(dst []byte, payloadJSON []byte) ([]byte, error)

+ func (v *Verifier) TrySignClaims(dst []byte, sub, username []byte, iat, exp int64) ([]byte, error)

+ func (v *Verifier) TrySignClaimsWithScratch(dst []byte, sub, username []byte, iat, exp int64, st *Scratch) ([]byte, error)

+ func (v *Verifier) TrySignWithScratch(dst []byte, payloadJSON []byte, st *Scratch) ([]byte, error)

Oct 20, 2026

Changes in this version

+ func ArrayElements(rawArray []byte, errOut ...*error) iter.Seq2[[]byte, bool]

+ func ObjectProperties(rawObject []byte, errOut ...*error) iter.Seq[JSONProp]

+ func ObjectProps(rawObject []byte, errOut ...*error) iter.Seq2[[]byte, []byte]

type Claims

+ HasIat bool

type ClaimsLarge

+ HasIat bool

+ type JSONProp struct

+ IsStr bool

+ Key []byte

+ Val []byte

type SignBuilder

+ func (b *SignBuilder) Discard()

Oct 19, 2026

Changes in this version

+ var ErrInvalidConfig = errors.New("zerojwt: invalid configuration")

+ var ErrMissingExp = errors.New("zerojwt: token has no exp claim")

+ var ErrNoSigningKey = errors.New("zerojwt: verifier has no signing key")

+ var ErrVerifierDestroyed = errors.New("zerojwt: verifier has been destroyed")

type Options

+ RequireExp bool

+ StrictSecretLength bool

type Verifier

+ func TryNewVerifier(secret []byte, opts Options) (*Verifier, error)

+ func (v *Verifier) CanSign() bool

Oct 19, 2026

retracted

Changes in this version

+ const MaxHeaderSize

+ const MaxPayloadSize

+ var ErrExpiredToken = errors.New("zerojwt: token is expired")

+ var ErrInvalidAudience = errors.New("zerojwt: invalid or mismatched token audience (aud)")

+ var ErrInvalidHeader = errors.New("zerojwt: invalid header or unsupported algorithm")

+ var ErrInvalidIssuer = errors.New("zerojwt: invalid or mismatched token issuer (iss)")

+ var ErrInvalidPayload = errors.New("zerojwt: invalid token payload claims")

+ var ErrInvalidSignature = errors.New("zerojwt: signature verification failed")

+ var ErrInvalidToken = errors.New("zerojwt: malformed token structure")

+ var ErrMissingBearer = errors.New("zerojwt: missing Bearer prefix")

+ var ErrNotValidYet = errors.New("zerojwt: token is not valid yet (nbf)")

+ var ErrPayloadTooLarge = errors.New("zerojwt: payload exceeds maximum zero-alloc buffer size")

+ var ErrUnknownKeyID = errors.New("zerojwt: unknown key ID (kid) in header")

+ func AppendEscapedJSONString(dst, s []byte) []byte

+ func NextArrayElement(b []byte) (val []byte, isStr bool, rest []byte, ok bool)

+ func NextJSONProp(b []byte) (key, val []byte, isStr bool, rest []byte, ok bool)

+ func ParseNumeric(b []byte) (float64, bool)

+ func ParsePositiveInt(val []byte) (int64, bool)

+ func TrimJSONArray(b []byte) ([]byte, bool)

+ func TrimJSONObject(b []byte) ([]byte, bool)

+ func UnescapeJSONInPlace(s []byte) []byte

+ type Algorithm string

+ const AlgES256

+ const AlgEdDSA

+ const AlgHS256

+ const AlgHS384

+ const AlgHS512

+ type Claims struct

+ ExpiresAt int64

+ HasAud bool

+ HasExp bool

+ HasIss bool

+ HasJti bool

+ HasNbf bool

+ HasSub bool

+ HasUsername bool

+ IssuedAt int64

+ NotBefore int64

+ SubjectID int64

+ func ClaimsFromContext(ctx context.Context) (*Claims, bool)

+ func (c *Claims) Audience() []byte

+ func (c *Claims) Clear()

+ func (c *Claims) Issuer() []byte

+ func (c *Claims) JTI() []byte

+ func (c *Claims) Reset()

+ func (c *Claims) Subject() []byte

+ func (c *Claims) Username() []byte

+ type ClaimsLarge struct

+ ExpiresAt int64

+ HasAud bool

+ HasExp bool

+ HasIss bool

+ HasJti bool

+ HasNbf bool

+ HasSub bool

+ HasUsername bool

+ IssuedAt int64

+ NotBefore int64

+ SubjectID int64

+ func (c *ClaimsLarge) Audience() []byte

+ func (c *ClaimsLarge) Clear()

+ func (c *ClaimsLarge) Issuer() []byte

+ func (c *ClaimsLarge) JTI() []byte

+ func (c *ClaimsLarge) Reset()

+ func (c *ClaimsLarge) Subject() []byte

+ func (c *ClaimsLarge) Username() []byte

+ type Key struct

+ ECDSAPublic *ecdsa.PublicKey

+ Ed25519Public ed25519.PublicKey

+ ID string

+ Secret []byte

+ type Options struct

+ ActiveKeyID string

+ Algorithm Algorithm

+ ECDSAPrivateKey *ecdsa.PrivateKey

+ ECDSAPublicKey *ecdsa.PublicKey

+ Ed25519PrivateKey ed25519.PrivateKey

+ Ed25519PublicKey ed25519.PublicKey

+ ExpectedAudience string

+ ExpectedIssuer string

+ Keys []Key

+ Leeway time.Duration

+ MaxHeaderSize int

+ MaxPayloadSize int

+ ZeroMemory bool

+ type Scratch struct

+ func (s *Scratch) Clear()

+ type SignBuilder struct

+ func (b *SignBuilder) SetAudience(aud []byte) *SignBuilder

+ func (b *SignBuilder) SetClaimBool(key string, val bool) *SignBuilder

+ func (b *SignBuilder) SetClaimBytes(key string, val []byte) *SignBuilder

+ func (b *SignBuilder) SetClaimInt(key string, val int64) *SignBuilder

+ func (b *SignBuilder) SetClaimRawJSON(key string, rawJSON []byte) *SignBuilder

+ func (b *SignBuilder) SetClaimString(key, val string) *SignBuilder

+ func (b *SignBuilder) SetExpiresAt(exp int64) *SignBuilder

+ func (b *SignBuilder) SetIssuedAt(iat int64) *SignBuilder

+ func (b *SignBuilder) SetIssuer(iss []byte) *SignBuilder

+ func (b *SignBuilder) SetJTI(jti []byte) *SignBuilder

+ func (b *SignBuilder) SetNotBefore(nbf int64) *SignBuilder

+ func (b *SignBuilder) SetSubject(sub []byte) *SignBuilder

+ func (b *SignBuilder) SetUsername(username []byte) *SignBuilder

+ func (b *SignBuilder) Sign() ([]byte, error)

+ type Verifier struct

+ func NewES256Verifier(pub *ecdsa.PublicKey, priv *ecdsa.PrivateKey, opts Options) *Verifier

+ func NewEd25519Verifier(pub ed25519.PublicKey, priv ed25519.PrivateKey, opts Options) *Verifier

+ func NewVerifier(secret []byte) *Verifier

+ func NewVerifierWithOptions(secret []byte, opts Options) *Verifier

+ func (v *Verifier) Destroy()

+ func (v *Verifier) Middleware(next http.Handler) http.Handler

+ func (v *Verifier) NewScratch() *Scratch

+ func (v *Verifier) NewSigner(dst []byte) SignBuilder

+ func (v *Verifier) NewSignerWithScratch(dst []byte, st *Scratch) SignBuilder

+ func (v *Verifier) ProtectFunc(next func(w http.ResponseWriter, r *http.Request, claims *Claims)) http.HandlerFunc

+ func (v *Verifier) Sign(dst []byte, payloadJSON []byte) []byte

+ func (v *Verifier) SignClaims(dst []byte, sub, username []byte, iat, exp int64) []byte

+ func (v *Verifier) SignHS256(dst []byte, payloadJSON []byte) []byte

+ func (v *Verifier) SignHS256WithScratch(dst []byte, payloadJSON []byte, st *Scratch) []byte

+ func (v *Verifier) SignWithScratch(dst []byte, payloadJSON []byte, st *Scratch) []byte

+ func (v *Verifier) Verify(tok []byte, nowUnix int64, out *Claims) error

+ func (v *Verifier) VerifyBearer(authHeader []byte, nowUnix int64, out *Claims) error

+ func (v *Verifier) VerifyCustom(tok []byte, nowUnix int64, onClaim func(key, val []byte, isStr bool) bool) error

+ func (v *Verifier) VerifyLarge(tok []byte, nowUnix int64, out *ClaimsLarge) error

+ func (v *Verifier) VerifyLargeWithScratch(tok []byte, nowUnix int64, out *ClaimsLarge, st *Scratch) error

+ func (v *Verifier) VerifyWithScratch(tok []byte, nowUnix int64, out *Claims, st *Scratch) error