Versions in this module Expand all Collapse all v1 v1.0.1 Aug 6, 2026 Changes in this version + var ErrAlgMismatch = errors.New("jwt: token alg not in verifier allowlist") + var ErrAudienceMismatch = errors.New("jwt: audience mismatch") + var ErrClaimMissing = errors.New("jwt: required claim missing") + var ErrIssuedInFuture = errors.New("jwt: token issued in the future (iat)") + var ErrIssuerMismatch = errors.New("jwt: issuer mismatch") + var ErrJWKSFetch = errors.New("jwt: jwks fetch failed") + var ErrJWKSTooLarge = errors.New("jwt: jwks response too large") + var ErrKeyNotFound = errors.New("jwt: no key matches kid") + var ErrKeyTypeMismatch = errors.New("jwt: key type does not match algorithm") + var ErrMalformedToken = errors.New("jwt: malformed compact serialization") + var ErrNotJWS = errors.New("jwt: not a JWS compact serialization (expected 3 segments)") + var ErrSignatureInvalid = errors.New("jwt: signature invalid") + var ErrTokenExpired = errors.New("jwt: token expired") + var ErrTokenNotYetValid = errors.New("jwt: token not yet valid (nbf)") + var ErrUnsupportedAlg = errors.New("jwt: unsupported or disallowed algorithm") + var ErrUnsupportedCrit = errors.New("jwt: unrecognized critical header parameter") + func Decode(raw string, v Verifier, validator *Validator) (MapClaims, RegisteredClaims, error) + func ES256Verify(pub *ecdsa.PublicKey) *ecdsaVerifyingKey + func ES384Verify(pub *ecdsa.PublicKey) *ecdsaVerifyingKey + func ES512Verify(pub *ecdsa.PublicKey) *ecdsaVerifyingKey + func EdDSASign(priv ed25519.PrivateKey) *ed25519SigningKey + func EdDSAVerify(pub ed25519.PublicKey) *ed25519VerifyingKey + func Encode(s Signer, claims MapClaims) (string, error) + func EncodeRegistered(s Signer, rc RegisteredClaims, extra MapClaims) (string, error) + func NewES256(priv *ecdsa.PrivateKey) *ecdsaSigningKey + func NewES384(priv *ecdsa.PrivateKey) *ecdsaSigningKey + func NewES512(priv *ecdsa.PrivateKey) *ecdsaSigningKey + func NewHS256(secret []byte) *hmacKey + func NewHS384(secret []byte) *hmacKey + func NewHS512(secret []byte) *hmacKey + func NewRS256(priv *rsa.PrivateKey) *rsaSigningKey + func NewRS384(priv *rsa.PrivateKey) *rsaSigningKey + func NewRS512(priv *rsa.PrivateKey) *rsaSigningKey + func RS256Verify(pub *rsa.PublicKey) *rsaVerifyingKey + func RS384Verify(pub *rsa.PublicKey) *rsaVerifyingKey + func RS512Verify(pub *rsa.PublicKey) *rsaVerifyingKey + type Algorithm string + const ES256 + const ES384 + const ES512 + const EdDSA + const HS256 + const HS384 + const HS512 + const RS256 + const RS384 + const RS512 + type Audience []string + func (a *Audience) UnmarshalJSON(b []byte) error + func (a Audience) Contains(v string) bool + func (a Audience) MarshalJSON() ([]byte, error) + type Clock interface + Now func() time.Time + type Header struct + Alg string + Crit []string + Cty string + Kid string + Typ string + type JWK struct + Alg string + Crv string + E string + K string + Kid string + Kty string + N string + Use string + X string + Y string + func ParseJWK(b []byte) (JWK, error) + func (k JWK) VerifyingKey() (VerifyingKey, error) + type JWKSClient struct + func NewJWKSClient(jwksURL string, opts ...JWKSOption) (*JWKSClient, error) + func (c *JWKSClient) Refresh(ctx context.Context) error + func (c *JWKSClient) Select(kid string, alg Algorithm) (VerifyingKey, error) + type JWKSOption func(*jwksConfig) + func AllowInsecureURL(allow bool) JWKSOption + func WithCacheTTL(d time.Duration) JWKSOption + func WithHTTPClient(c *http.Client) JWKSOption + func WithMaxResponseBytes(n int64) JWKSOption + func WithMinRefreshInterval(d time.Duration) JWKSOption + type JWKSet struct + Keys []JWK + func ParseJWKSet(b []byte) (JWKSet, error) + type KeySelector interface + Select func(kid string, alg Algorithm) (VerifyingKey, error) + type MapClaims map[string]any + func (m MapClaims) Audience() Audience + func (m MapClaims) GetString(name string) (string, bool) + func (m MapClaims) GetStringSlice(name string) ([]string, bool) + func (m MapClaims) Registered() (RegisteredClaims, error) + type NumericDate struct + func NewNumericDate(t time.Time) *NumericDate + func (n *NumericDate) UnmarshalJSON(b []byte) error + func (n NumericDate) MarshalJSON() ([]byte, error) + type RegisteredClaims struct + Audience Audience + ExpiresAt *NumericDate + ID string + IssuedAt *NumericDate + Issuer string + NotBefore *NumericDate + Subject string + type Signer interface + Algorithm func() Algorithm + Sign func(signingInput []byte) ([]byte, error) + func NewSigner(key SigningKey, kid string) (Signer, error) + type SigningKey interface + Algorithm func() Algorithm + type ValidationOption func(*Validator) + func WithClock(c Clock) ValidationOption + func WithLeeway(skew time.Duration) ValidationOption + func WithRequireExpiry(required bool) ValidationOption + func WithRequiredAudience(aud string) ValidationOption + func WithRequiredIssuer(iss string) ValidationOption + func WithValidateIAT(required bool) ValidationOption + type Validator struct + func NewValidator(opts ...ValidationOption) *Validator + func (v *Validator) Validate(c RegisteredClaims) error + type Verifier interface + Allowed func() []Algorithm + Verify func(h Header, signingInput, sig []byte) error + func NewVerifier(allow []Algorithm, sel KeySelector) (Verifier, error) + func NewVerifierKey(alg Algorithm, key VerifyingKey) (Verifier, error) + type VerifyingKey interface + Algorithm func() Algorithm v1.0.0 Aug 6, 2026
Go to main page