JwtClaims

A token's registered claims (RFC 7519 §4.1), once crypto.verify_jwt has checked its signature, times, issuer and audience: aud is a list, and exp always there.

Security; not ordered; since Jadpo 0.1.0.

Make one

Build one from its fields, JwtClaims { aud: ... exp: ... }.

This operation gives one: crypto.verify_jwt.

Fields

Text, JSON and storage

It has no single text form, so text.from and text.parse don't take it. JSON sends an object of its parts.

It is stored in 7 columns, each named for the field, _ and its suffix. This is {"iss":"https://id.example.com","aud":[],"exp":"2026-10-18T10:00:00Z"}:

Shown to people

text.format(value, locale:) shows it to people in their locale.

With locale: Locale.en_gb:

Operations

• crypto.verify_jwt(token: Jwt, keys: List<Jwk>, issuer: Text?, audience: Text?, as: Type?) -> JwtClaims: The registered claims of token once it holds: signed by one of keys with that key's own algorithm (Ed25519, RS256 for an RSA key, ES256 for a P-256 key), never the one the token names, so none and every other algorithm fail invalid_signature; not expired, not used before its nbf and not issued later than now, against the clock with 30 seconds' leeway (expired, not_yet_valid); issued by issuer when one is given (wrong_issuer); and for audience, or for no audience when none is given (wrong_audience). A token that isn't one, or has no exp, is malformed. With as:, an object type of the application's, it gives instead the token's claims the type names, read as json.read reads it, a registered one as JwtClaims holds it, and fails mismatch when they aren't the type. It reads the clock, so it is called only in actions.

Like every standard type, it also has the contract's own operations: text.format, json.read, json.write and ==. It isn't ordered, so < and sorting don't take it. Every standard type meets one contract says how they work.