std::jwt

Status: experimental

RFC 7519 tokens. Signs with HS256 / HS384 / HS512, ES256, and EdDSA; verifies those plus the RS256 / RS384 / RS512 family every mainstream identity provider mints with. Claims cross the boundary as JSON text.

API details and source

The implementation source contains the complete declarations and implementation notes. The table below lists canonical Gossamer call signatures; every item name links directly to its implementation file.

Item	Canonical signature or declaration	Description
Alg	type Alg	Signing algorithm: HS256 / HS384 / HS512 / ES256 / EdDSA.
Claims	type Claims	Standard registered claims plus a free-form custom map.
Header	type Header	JWS / JWT header (alg, kid, typ).
VerifyOpts	type VerifyOpts	Expected issuer / audience / clock leeway used by verify.
sign_eddsa	fn sign_eddsa(claims_json: String, signing_key_pem: String) -> Result<String, errors::Error>	Sign with Ed25519 from a PEM-encoded private key.
sign_es256	fn sign_es256(claims_json: String, signing_key_pem: String) -> Result<String, errors::Error>	Sign with ECDSA P-256 from a PEM-encoded private key.
sign_hs	fn sign_hs(alg: String, claims_json: String, key: Vec<u8>) -> Result<String, errors::Error>	Sign claims with HMAC-SHA family using a shared key.
verify_eddsa	fn verify_eddsa(token: String, verifying_key_pem: String, leeway_secs: i64) -> Result<String, errors::Error>	Verify an EdDSA token against a PEM-encoded public key.
verify_es256	fn verify_es256(token: String, verifying_key_pem: String, leeway_secs: i64) -> Result<String, errors::Error>	Verify an ES256 token against a PEM-encoded public key.
verify_hs	fn verify_hs(token: String, alg: String, key: Vec<u8>, leeway_secs: i64) -> Result<String, errors::Error>	Verify an HS* token; checks signature plus VerifyOpts.