# `Jwt`

A signed token (RFC 7519) in JWS compact form, three parts of unpadded Base64url joined by `.`, at most 8,192 characters; an unsecured token, with no signature, is never one. `crypto.verify_jwt` checks it. A secret value (chunk 5.5r2): never sent, logged, stored or shown, and compared in constant time.

[Security](types.md#security); not ordered; since Jadpo 0.1.0.

## Make one

It comes from outside your code, a secret value that never appears in it.

`text.parse(raw, as: Jwt)` reads one from its text; text that isn't one at all fails `malformed`, such as `""`.

## Text, JSON and storage

`text.parse` reads one from its text, as it is typed. Nothing writes it: `text.from` and `text.format` don't take it, JSON writes it as `"<redacted Jwt>"`, and it is never stored.

## Shown to people

`text.format` doesn't take it: a `Jwt` is never shown.

## Operations

- `crypto.verify_jwt(token: Jwt, keys: List<Jwk>, issuer: Text?, audience: Text?, as: Type?) -> JwtClaims`: The registered claims of `token` once it holds: signed by one of `keys` with that key's own algorithm (Ed25519, RS256 for an RSA key, ES256 for a P-256 key), never the one the token names, so `none` and every other algorithm fail `invalid_signature`; not expired, not used before its `nbf` and not issued later than now, against the clock with 30 seconds' leeway (`expired`, `not_yet_valid`); issued by `issuer` when one is given (`wrong_issuer`); and for `audience`, or for no audience when none is given (`wrong_audience`). A token that isn't one, or has no `exp`, is `malformed`. With `as:`, an object type of the application's, it gives instead the token's claims the type names, read as `json.read` reads it, a registered one as `JwtClaims` holds it, and fails `mismatch` when they aren't the type. It reads the clock, so it is called only in actions.

Like every standard type, it also has the contract's own operations: `text.parse`, `json.read`, `json.write` and `==`. It isn't ordered, so `<` and sorting don't take it. [Every standard type meets one contract](../topics/every-standard-type-meets-one-contract.md) says how they work.