{"id":13796733,"url":"https://github.com/DCIT/perl-Crypt-JWT","last_synced_at":"2025-05-13T00:31:09.463Z","repository":{"id":34520043,"uuid":"38462137","full_name":"DCIT/perl-Crypt-JWT","owner":"DCIT","description":null,"archived":false,"fork":false,"pushed_at":"2024-01-23T18:55:40.000Z","size":183,"stargazers_count":54,"open_issues_count":5,"forks_count":18,"subscribers_count":8,"default_branch":"master","last_synced_at":"2024-08-04T23:10:41.154Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Perl","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/DCIT.png","metadata":{"files":{"readme":"README.md","changelog":"Changes","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null}},"created_at":"2015-07-02T23:42:54.000Z","updated_at":"2024-03-12T12:39:35.000Z","dependencies_parsed_at":"2024-01-15T10:58:42.406Z","dependency_job_id":"81cf2e00-3a75-4c9c-a689-6dceee497aa2","html_url":"https://github.com/DCIT/perl-Crypt-JWT","commit_stats":null,"previous_names":[],"tags_count":24,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/DCIT%2Fperl-Crypt-JWT","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/DCIT%2Fperl-Crypt-JWT/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/DCIT%2Fperl-Crypt-JWT/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/DCIT%2Fperl-Crypt-JWT/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/DCIT","download_url":"https://codeload.github.com/DCIT/perl-Crypt-JWT/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":225159878,"owners_count":17430202,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-03T23:01:14.398Z","updated_at":"2025-05-13T00:31:09.443Z","avatar_url":"https://github.com/DCIT.png","language":"Perl","funding_links":[],"categories":["Libraries"],"sub_categories":["Perl"],"readme":"# NAME\n\nCrypt::JWT - JSON Web Token (JWT, JWS, JWE) as defined by RFC7519, RFC7515, RFC7516\n\n# SYNOPSIS\n\n    # encoding\n    use Crypt::JWT qw(encode_jwt);\n    my $jws_token = encode_jwt(payload=\u003e$data, alg=\u003e'HS256', key=\u003e'secret');\n    my $jwe_token = encode_jwt(payload=\u003e$data, alg=\u003e'PBES2-HS256+A128KW', enc=\u003e'A128GCM', key=\u003e'secret');\n\n    # decoding\n    use Crypt::JWT qw(decode_jwt);\n    my $data1 = decode_jwt(token=\u003e$jws_token, key=\u003e'secret');\n    my $data2 = decode_jwt(token=\u003e$jwe_token, key=\u003e'secret');\n\n# DESCRIPTION\n\nImplements **JSON Web Token (JWT)** - [https://tools.ietf.org/html/rfc7519](https://tools.ietf.org/html/rfc7519).\nThe implementation covers not only **JSON Web Signature (JWS)** - [https://tools.ietf.org/html/rfc7515](https://tools.ietf.org/html/rfc7515),\nbut also **JSON Web Encryption (JWE)** - [https://tools.ietf.org/html/rfc7516](https://tools.ietf.org/html/rfc7516).\n\nThe module implements **all (100%) algorithms** defined in [https://tools.ietf.org/html/rfc7518](https://tools.ietf.org/html/rfc7518) - **JSON Web Algorithms (JWA)**.\n\nThis module supports **Compact JWS/JWE** and **Flattened JWS/JWE JSON** serialization, general JSON serialization is not supported yet.\n\n# EXPORT\n\nNothing is exported by default.\n\nYou can export selected functions:\n\n    use Crypt::JWT qw(decode_jwt encode_jwt);\n\nOr all of them at once:\n\n    use Crypt::JWT ':all';\n\n# FUNCTIONS\n\n## decode\\_jwt\n\n    my $data = decode_jwt(%named_args);\n\nNamed arguments:\n\n- token\n\n    Mandatory argument, a string with either JWS or JWE JSON Web Token.\n\n        ### JWS token example (3 segments)\n        $t = \"eyJhbGciOiJIUzI1NiJ9.dGVzdA.ujBihtLSr66CEWqN74SpLUkv28lra_CeHnxLmLNp4Jo\";\n        my $data = decode_jwt(token=\u003e$t, key=\u003e$k);\n\n        ### JWE token example (5 segments)\n        $t = \"eyJlbmMiOiJBMTI4R0NNIiwiYWxnIjoiQTEyOEtXIn0.UusxEbzhGkORxTRq0xkFKhvzPrXb9smw.VGfOuq0Fxt6TsdqLZUpnxw.JajIQQ.pkKZ7MHS0XjyGmRsqgom6w\";\n        my $data = decode_jwt(token=\u003e$t, key=\u003e$k);\n\n- key\n\n    A key used for token decryption (JWE) or token signature validation (JWS).\n    The value depends on the `alg` token header value.\n\n        JWS alg header      key value\n        ------------------  ----------------------------------\n        none                no key required\n        HS256               string (raw octects) of any length (or perl HASH ref with JWK, kty=\u003e'oct')\n        HS384               dtto\n        HS512               dtto\n        RS256               public RSA key, perl HASH ref with JWK key structure,\n                            a reference to SCALAR string with PEM or DER or JSON/JWK data,\n                            object: Crypt::PK::RSA, Crypt::OpenSSL::RSA, Crypt::X509 or Crypt::OpenSSL::X509\n        RS384               public RSA key, see RS256\n        RS512               public RSA key, see RS256\n        PS256               public RSA key, see RS256\n        PS384               public RSA key, see RS256\n        PS512               public RSA key, see RS256\n        ES256               public ECC key, perl HASH ref with JWK key structure,\n                            a reference to SCALAR string with PEM or DER or JSON/JWK data,\n                            an instance of Crypt::PK::ECC\n        ES256K              public ECC key, see ES256\n        ES384               public ECC key, see ES256\n        ES512               public ECC key, see ES256\n        EdDSA               public Ed25519 key\n\n        JWE alg header      key value\n        ------------------  ----------------------------------\n        dir                 string (raw octects) or perl HASH ref with JWK, kty=\u003e'oct', length depends on 'enc' algorithm\n        A128KW              string (raw octects) 16 bytes (or perl HASH ref with JWK, kty=\u003e'oct')\n        A192KW              string (raw octects) 24 bytes (or perl HASH ref with JWK, kty=\u003e'oct')\n        A256KW              string (raw octects) 32 bytes (or perl HASH ref with JWK, kty=\u003e'oct')\n        A128GCMKW           string (raw octects) 16 bytes (or perl HASH ref with JWK, kty=\u003e'oct')\n        A192GCMKW           string (raw octects) 24 bytes (or perl HASH ref with JWK, kty=\u003e'oct')\n        A256GCMKW           string (raw octects) 32 bytes (or perl HASH ref with JWK, kty=\u003e'oct')\n        PBES2-HS256+A128KW  string (raw octects) of any length (or perl HASH ref with JWK, kty=\u003e'oct')\n        PBES2-HS384+A192KW  string (raw octects) of any length (or perl HASH ref with JWK, kty=\u003e'oct')\n        PBES2-HS512+A256KW  string (raw octects) of any length (or perl HASH ref with JWK, kty=\u003e'oct')\n        RSA-OAEP            private RSA key, perl HASH ref with JWK key structure,\n                            a reference to SCALAR string with PEM or DER or JSON/JWK data,\n                            an instance of Crypt::PK::RSA or Crypt::OpenSSL::RSA\n        RSA-OAEP-256        private RSA key, see RSA-OAEP\n        RSA1_5              private RSA key, see RSA-OAEP\n        ECDH-ES             private ECC or X25519 key, perl HASH ref with JWK key structure,\n                            a reference to SCALAR string with PEM or DER or JSON/JWK data,\n                            an instance of Crypt::PK::ECC\n        ECDH-ES+A128KW      private ECC or X25519 key, see ECDH-ES\n        ECDH-ES+A192KW      private ECC or X25519 key, see ECDH-ES\n        ECDH-ES+A256KW      private ECC or X25519 key, see ECDH-ES\n\n    Example using the key from `jwk` token header:\n\n        my $data = decode_jwt(token=\u003e$t, key_from_jwk_header=\u003e1);\n        my ($header, $data) = decode_jwt(token=\u003e$t, decode_header=\u003e1, key_from_jwk_header=\u003e1);\n\n    Examples with raw octet keys:\n\n        #string\n        my $data = decode_jwt(token=\u003e$t, key=\u003e'secretkey');\n        #binary key\n        my $data = decode_jwt(token=\u003e$t, key=\u003epack(\"H*\", \"788A6E38F36B7596EF6A669E94\"));\n        #perl HASH ref with JWK structure (key type 'oct')\n        my $data = decode_jwt(token=\u003e$t, key=\u003e{kty=\u003e'oct', k=\u003e\"GawgguFyGrWKav7AX4VKUg\"});\n\n    Examples with RSA keys:\n\n        my $pem_key_string = \u003c\u003c'EOF';\n        -----BEGIN PRIVATE KEY-----\n        MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCoVm/Sl5r+Ofky\n        jioRSZK26GW6WyjyfWKddsSi13/NOtCn0rRErSF/u3QrgGMpWFqKohqbi1VVC+SZ\n        ...\n        8c1vm2YFafgdkSk9Qd1oU2Fv1aOQy4VovOFzJ3CcR+2r7cbRfcpLGnintHtp9yek\n        02p+d5g4OChfFNDhDtnIqjvY\n        -----END PRIVATE KEY-----\n        EOF\n\n        my $jwk_key_json_string = '{\"kty\":\"RSA\",\"n\":\"0vx7agoebG...L6tSoc_BJECP\",\"e\":\"AQAB\"}';\n\n        #a reference to SCALAR string with PEM or DER or JSON/JWK data,\n        my $data = decode_jwt(token=\u003e$t, key=\u003e\\$pem_key_string);\n        my $data = decode_jwt(token=\u003e$t, key=\u003e\\$der_key_string);\n        my $data = decode_jwt(token=\u003e$t, key=\u003e\\$jwk_key_json_string);\n\n        #instance of Crypt::PK::RSA\n        my $data = decode_jwt(token=\u003e$t, key=\u003eCrypt::PK::RSA-\u003enew('keyfile.pem'));\n        my $data = decode_jwt(token=\u003e$t, key=\u003eCrypt::PK::RSA-\u003enew(\\$pem_key_string));\n\n        #instance of Crypt::OpenSSL::RSA\n        my $data = decode_jwt(token=\u003e$t, key=\u003eCrypt::OpenSSL::RSA-\u003enew_private_key($pem_key_string));\n\n        #instance of Crypt::X509 (public key only)\n        my $data = decode_jwt(token=\u003e$t, key=\u003eCrypt::X509-\u003enew(cert=\u003e$cert));\n\n        #instance of Crypt::OpenSSL::X509 (public key only)\n        my $data = decode_jwt(token=\u003e$t, key=\u003eCrypt::OpenSSL::X509-\u003enew_from_file('cert.pem'));\n        my $data = decode_jwt(token=\u003e$t, key=\u003eCrypt::OpenSSL::X509-\u003enew_from_string($cert));\n\n        #perl HASH ref with JWK structure (key type 'RSA')\n        my $rsa_priv = {\n          kty =\u003e \"RSA\",\n          n   =\u003e \"0vx7agoebGcQSuuPiLJXZpt...eZu0fM4lFd2NcRwr3XPksINHaQ-G_xBniIqbw0Ls1jF44-csFCur-kEgU8awapJzKnqDKgw\",\n          e   =\u003e \"AQAB\",\n          d   =\u003e \"X4cTteJY_gn4FYPsXB8rdXi...FLN5EEaG6RoVH-HLKD9Mdx5ooGURknhnrRwUkC7h5fJLMWbFAKLWY2v7B6NqSzUvx0_YSf\",\n          p   =\u003e \"83i-7IvMGXoMXCskv73TKr8...Z27zvoj6pbUQyLPBQxtPnwD20-60eTmD2ujMt5PoMrm8RmNhVWtjjMmMjOpSicFHjXOuVI\",\n          q   =\u003e \"3dfOR9cuYq-0S-mkFLzgItg...q3hWeMuG0ouqnb3obLyuqjVZQ1dIrdgTnCdYzBcOW5r37AFXjift_NGiovonzhKpoVVS78\",\n          dp  =\u003e \"G4sPXkc6Ya9y8oJW9_ILj4...zi_H7TkS8x5SdX3oE0oiYwxIiemTAu0UOa5pgFGyJ4c8t2VF40XRugKTP8akhFo5tA77Qe\",\n          dq  =\u003e \"s9lAH9fggBsoFR8Oac2R_E...T2kGOhvIllTE1efA6huUvMfBcpn8lqW6vzzYY5SSF7pMd_agI3G8IbpBUb0JiraRNUfLhc\",\n          qi  =\u003e \"GyM_p6JrXySiz1toFgKbWV...4ypu9bMWx3QJBfm0FoYzUIZEVEcOqwmRN81oDAaaBk0KWGDjJHDdDmFW3AN7I-pux_mHZG\",\n        };\n        my $data = decode_jwt(token=\u003e$t, key=\u003e$rsa_priv});\n\n    Examples with ECC keys:\n\n        my $pem_key_string = \u003c\u003c'EOF';\n        -----BEGIN EC PRIVATE KEY-----\n        MHcCAQEEIBG1c3z52T8XwMsahGVdOZWgKCQJfv+l7djuJjgetdbDoAoGCCqGSM49\n        AwEHoUQDQgAEoBUyo8CQAFPeYPvv78ylh5MwFZjTCLQeb042TjiMJxG+9DLFmRSM\n        lBQ9T/RsLLc+PmpB1+7yPAR+oR5gZn3kJQ==\n        -----END EC PRIVATE KEY-----\n        EOF\n\n        my $jwk_key_json_string = '{\"kty\":\"EC\",\"crv\":\"P-256\",\"x\":\"MKB..7D4\",\"y\":\"4Et..FyM\"}';\n\n        #a reference to SCALAR string with PEM or DER or JSON/JWK data,\n        my $data = decode_jwt(token=\u003e$t, key=\u003e\\$pem_key_string);\n        my $data = decode_jwt(token=\u003e$t, key=\u003e\\$der_key_string);\n        my $data = decode_jwt(token=\u003e$t, key=\u003e\\$jwk_key_json_string);\n\n        #instance of Crypt::PK::ECC\n        my $data = decode_jwt(token=\u003e$t, key=\u003eCrypt::PK::ECC-\u003enew('keyfile.pem'));\n        my $data = decode_jwt(token=\u003e$t, key=\u003eCrypt::PK::ECC-\u003enew(\\$pem_key_string));\n\n        #perl HASH ref with JWK structure (key type 'EC')\n        my $ecc_priv = {\n          kty =\u003e \"EC\",\n          crv =\u003e \"P-256\",\n          x   =\u003e \"MKBCTNIcKUSDii11ySs3526iDZ8AiTo7Tu6KPAqv7D4\",\n          y   =\u003e \"4Etl6SRW2YiLUrN5vfvVHuhp7x8PxltmWWlbbM4IFyM\",\n          d   =\u003e \"870MB6gfuTJ4HtUnUvYMyJpr5eUZNP4Bk43bVdj3eAE\",\n        };\n        my $data = decode_jwt(token=\u003e$t, key=\u003e$ecc_priv});\n\n- keypass\n\n    When 'key' parameter is an encrypted private RSA or ECC key this optional parameter may contain a password for private key decryption.\n\n- kid\\_keys\n\n    This parametes can be either a JWK Set JSON string (see RFC7517) or a perl HASH ref with JWK Set structure like this:\n\n        my $keylist = {\n          keys =\u003e [\n            { kid=\u003e\"key1\", kty=\u003e\"oct\", k=\u003e\"GawgguFyGrWKav7AX4VKUg\" },\n            { kid=\u003e\"key2\", kty=\u003e\"oct\", k=\u003e\"ulxLGy4XqhbpkR5ObGh1gX\" },\n          ]\n        };\n        my $payload = decode_jwt(token=\u003e$t, kid_keys=\u003e$keylist);\n\n    You can use [\"export\\_key\\_jwk\" in Crypt::PK::RSA](https://metacpan.org/pod/Crypt%3A%3APK%3A%3ARSA#export_key_jwk) to generate a JWK for RSA:\n\n        my $pubkey = Crypt::PK::RSA-\u003enew('rs256-4096-public.pem');\n        my $jwk_hash = $pubkey-\u003eexport_key_jwk('public', 1);\n        $jwk_hash-\u003e{kid} = 'key1';\n        my $keylist = {\n          keys =\u003e [\n            $jwk_hash,\n          ]\n        };\n\n    The structure described above is used e.g. by [https://www.googleapis.com/oauth2/v2/certs](https://www.googleapis.com/oauth2/v2/certs)\n\n        use Mojo::UserAgent;\n        my $ua = Mojo::UserAgent-\u003enew;\n        my $google_keys =\u003e $ua-\u003eget('https://www.googleapis.com/oauth2/v2/certs')-\u003eresult-\u003ejson;\n        my $payload = decode_jwt(token =\u003e $t, kid_keys =\u003e $google_keys);\n\n    **SINCE 0.019** we also support alternative structure used e.g. by [https://www.googleapis.com/oauth2/v1/certs](https://www.googleapis.com/oauth2/v1/certs):\n\n        use LWP::Simple;\n        my $google_certs = get('https://www.googleapis.com/oauth2/v1/certs');\n        my $payload = decode_jwt(token =\u003e $t, kid_keys =\u003e $google_certs);\n\n    When the token header contains `kid` item the corresponding key is looked up in `kid_keys` list and used for token\n    decoding (you do not need to pass the explicit key via `key` parameter). Add a kid header using [\"extra\\_headers\"](#extra_headers).\n\n    **INCOMPATIBLE CHANGE in 0.023:** When `kid_keys` is specified it croaks if token header does not contain `kid` value or\n    if `kid` was not found in `kid_keys`.\n\n- key\\_from\\_jwk\\_header\n\n    **SINCE 0.023**\n\n    `1` - use `jwk` header value for validating JWS signature if neither `key` nor `kid_keys` specified, **BEWARE: DANGEROUS, UNSECURE!!!**\n\n    `0` (default) - ignore `jwk` header value when validating JWS signature\n\n    Keep in mind that enabling `key_from_jwk_header` requires `jwk` header to exist and be an valid RSA/ECDSA public key (otherwise it croaks).\n\n- allow\\_none\n\n    `1` - accept JWS tokens with `none` 'alg' header value (which means that token has no signature), **BEWARE: DANGEROUS, UNSECURE!!!**\n\n    `0` (default) - do not allow JWS with `none` 'alg' header value\n\n- ignore\\_signature\n\n    `1` - do not check signature on JWS tokens, **BEWARE: DANGEROUS, UNSECURE!!!**\n\n    `0` (default) - check signature on JWS tokens\n\n- accepted\\_alg\n\n    `undef` (default) means accept all 'alg' algorithms except 'none' (for accepting 'none' use `allow_none`)\n\n    `string` name of accepted 'alg' algorithm (only one)\n\n    `ARRAY ref` a list of accepted 'alg' algorithms\n\n    `Regexp` that has to match 'alg' algorithm name\n\n        my $payload = decode_jwt(token=\u003e$t, key=\u003e$k, accepted_alg=\u003e'HS256');\n        #or\n        my $payload = decode_jwt(token=\u003e$t, key=\u003e$k, accepted_alg=\u003e['HS256','HS384']);\n        #or\n        my $payload = decode_jwt(token=\u003e$t, key=\u003e$k, accepted_alg=\u003eqr/^HS(256|384|512)$/);\n\n- accepted\\_enc\n\n    `undef` (default) means accept all 'enc' algorithms\n\n    `string` name of accepted 'enc' algorithm (only one)\n\n    `ARRAY ref` a list of accepted 'enc' algorithms\n\n    `Regexp` that has to match 'enc' algorithm name\n\n        my $payload = decode_jwt(token=\u003e$t, key=\u003e$k, accepted_enc=\u003e'A192GCM');\n        #or\n        my $payload = decode_jwt(token=\u003e$t, key=\u003e$k, accepted_enc=\u003e['A192GCM','A256GCM']);\n        #or\n        my $payload = decode_jwt(token=\u003e$t, key=\u003e$k, accepted_enc=\u003eqr/^A(128|192|256)GCM$/);\n\n- decode\\_payload\n\n    `0` - do not decode payload, return it as a raw string (octects).\n\n    `1` - decode payload from JSON string, return it as perl hash ref (or array ref) - decode\\_json failure means fatal error (croak).\n\n    `undef` (default) - if possible decode payload from JSON string, if decode\\_json fails return payload as a raw string (octets).\n\n- decode\\_header\n\n    `0` (default) - do not return decoded header as a return value of decode\\_jwt()\n\n    `1` - return decoded header as a return value of decode\\_jwt()\n\n        my $payload = decode_jwt(token=\u003e$t, key=\u003e$k);\n        #or\n        my ($header, $payload) = decode_jwt(token=\u003e$t, key=\u003e$k, decode_header=\u003e1);\n\n- verify\\_iss\n\n    **INCOMPATIBLE CHANGE in 0.024:** If `verify_iss` is specified and\n    claim `iss` (Issuer) is completely missing it is a failure since 0.024\n\n    `CODE ref` - subroutine (with 'iss' claim value passed as argument) should return `true` otherwise verification fails\n\n    `Regexp ref` - 'iss' claim value has to match given regexp otherwise verification fails\n\n    `Scalar` - 'iss' claim value has to be equal to given string (since 0.029)\n\n    `undef` (default) - do not verify 'iss' claim\n\n- verify\\_aud\n\n    **INCOMPATIBLE CHANGE in 0.024:** If `verify_aud` is specified and\n    claim `aud` (Audience) is completely missing it is a failure since 0.024\n\n    `CODE ref` - subroutine (with 'aud' claim value passed as argument) should return `true` otherwise verification fails\n\n    `Regexp ref` - 'aud' claim value has to match given regexp otherwise verification fails\n\n    `Scalar` - 'aud' claim value has to be equal to given string (since 0.029)\n\n    `undef` (default) - do not verify 'aud' claim\n\n    **SINCE 0.036** we handle 'aud' claim when it contains an array of strings. In this case, the check should succeed if at least one\n    value from the array matches. All checks (CODE, Regexp, Scalar) are performed individually against each member of the array of strings.\n\n- verify\\_sub\n\n    **INCOMPATIBLE CHANGE in 0.024:** If `verify_sub` is specified and\n    claim `sub` (Subject) is completely missing it is a failure since 0.024\n\n    `CODE ref` - subroutine (with 'sub' claim value passed as argument) should return `true` otherwise verification fails\n\n    `Regexp ref` - 'sub' claim value has to match given regexp otherwise verification fails\n\n    `Scalar` - 'sub' claim value has to be equal to given string (since 0.029)\n\n    `undef` (default) - do not verify 'sub' claim\n\n- verify\\_jti\n\n    **INCOMPATIBLE CHANGE in 0.024:** If `verify_jti` is specified and\n    claim `jti` (JWT ID) is completely missing it is a failure since 0.024\n\n    `CODE ref` - subroutine (with 'jti' claim value passed as argument) should return `true` otherwise verification fails\n\n    `Regexp ref` - 'jti' claim value has to match given regexp otherwise verification fails\n\n    `Scalar` - 'jti' claim value has to be equal to given string (since 0.029)\n\n    `undef` (default) - do not verify 'jti' claim\n\n- verify\\_iat\n\n    `undef` - Issued At 'iat' claim must be valid (not in the future) if present\n\n    `0` (default) - ignore 'iat' claim\n\n    `1` - require valid 'iat' claim\n\n- verify\\_nbf\n\n    `undef` (default) - Not Before 'nbf' claim must be valid if present\n\n    `0` - ignore 'nbf' claim\n\n    `1` - require valid 'nbf' claim\n\n- verify\\_exp\n\n    `undef` (default) - Expiration Time 'exp' claim must be valid if present\n\n    `0` - ignore 'exp' claim\n\n    `1` - require valid 'exp' claim\n\n- leeway\n\n    Tolerance in seconds related to `verify_exp`, `verify_nbf` and `verify_iat`. Default is `0`.\n\n- ignore\\_claims\n\n    `1` - do not check claims (iat, exp, nbf, iss, aud, sub, jti), **BEWARE: DANGEROUS, UNSECURE!!!**\n\n    `0` (default) - check claims\n\n- verify\\_typ\n\n    **SINCE 0.036**\n\n    `CODE ref` - subroutine (with 'typ' header parameter value passed as argument) should return `true` otherwise verification fails\n\n    `Regexp ref` - 'typ' header parameter value has to match given regexp otherwise verification fails\n\n    `Scalar` - 'typ' header parameter value has to be equal to given string\n\n    `undef` (default) - do not verify 'typ' header parameter\n\n## encode\\_jwt\n\n    my $token = encode_jwt(%named_args);\n\nNamed arguments:\n\n- payload\n\n    Value of this mandatory parameter can be a string/buffer or HASH ref or ARRAY ref\n\n        my $token = encode_jwt(payload=\u003e\"any raw data\", key=\u003e$k, alg=\u003e'HS256');\n        #or\n        my $token = encode_jwt(payload=\u003e{a=\u003e1,b=\u003e2}, key=\u003e$k, alg=\u003e'HS256');\n        #or\n        my $token = encode_jwt(payload=\u003e[11,22,33,44], key=\u003e$k, alg=\u003e'HS256');\n\n    HASH refs and ARRAY refs payloads are serialized as JSON strings\n\n- alg\n\n    The 'alg' header value is mandatory for both JWE and JWS tokens.\n\n    Supported JWE 'alg' algorithms:\n\n        dir\n        A128KW\n        A192KW\n        A256KW\n        A128GCMKW\n        A192GCMKW\n        A256GCMKW\n        PBES2-HS256+A128KW\n        PBES2-HS384+A192KW\n        PBES2-HS512+A256KW\n        RSA-OAEP\n        RSA-OAEP-256\n        RSA1_5\n        ECDH-ES+A128KW\n        ECDH-ES+A192KW\n        ECDH-ES+A256KW\n        ECDH-ES\n\n    Supported JWS algorithms:\n\n        none   ...  no integrity (NOTE: disabled by default)\n        HS256  ...  HMAC+SHA256 integrity\n        HS384  ...  HMAC+SHA384 integrity\n        HS512  ...  HMAC+SHA512 integrity\n        RS256  ...  RSA+PKCS1-V1_5 + SHA256 signature\n        RS384  ...  RSA+PKCS1-V1_5 + SHA384 signature\n        RS512  ...  RSA+PKCS1-V1_5 + SHA512 signature\n        PS256  ...  RSA+PSS + SHA256 signature\n        PS384  ...  RSA+PSS + SHA384 signature\n        PS512  ...  RSA+PSS + SHA512 signature\n        ES256  ...  ECDSA + SHA256 signature\n        ES256K ...  ECDSA + SHA256 signature\n        ES384  ...  ECDSA + SHA384 signature\n        ES512  ...  ECDSA + SHA512 signature\n        EdDSA  ...  Ed25519 signature\n\n- enc\n\n    The 'enc' header is mandatory for JWE tokens.\n\n    Supported 'enc' algorithms:\n\n        A128GCM\n        A192GCM\n        A256GCM\n        A128CBC-HS256\n        A192CBC-HS384\n        A256CBC-HS512\n\n- key\n\n    A key used for token encryption (JWE) or token signing (JWS). The value depends on `alg` token header value.\n\n        JWS alg header      key value\n        ------------------  ----------------------------------\n        none                no key required\n        HS256               string (raw octects) of any length (or perl HASH ref with JWK, kty=\u003e'oct')\n        HS384               dtto\n        HS512               dtto\n        RS256               private RSA key, perl HASH ref with JWK key structure,\n                            a reference to SCALAR string with PEM or DER or JSON/JWK data,\n                            object: Crypt::PK::RSA, Crypt::OpenSSL::RSA, Crypt::X509 or Crypt::OpenSSL::X509\n        RS384               private RSA key, see RS256\n        RS512               private RSA key, see RS256\n        PS256               private RSA key, see RS256\n        PS384               private RSA key, see RS256\n        PS512               private RSA key, see RS256\n        ES256               private ECC key, perl HASH ref with JWK key structure,\n                            a reference to SCALAR string with PEM or DER or JSON/JWK data,\n                            an instance of Crypt::PK::ECC\n        ES256K              private ECC key, see ES256\n        ES384               private ECC key, see ES256\n        ES512               private ECC key, see ES256\n        EdDSA               private Ed25519 key\n\n        JWE alg header      key value\n        ------------------  ----------------------------------\n        dir                 string (raw octects) or perl HASH ref with JWK, kty=\u003e'oct', length depends on 'enc' algorithm\n        A128KW              string (raw octects) 16 bytes (or perl HASH ref with JWK, kty=\u003e'oct')\n        A192KW              string (raw octects) 24 bytes (or perl HASH ref with JWK, kty=\u003e'oct')\n        A256KW              string (raw octects) 32 bytes (or perl HASH ref with JWK, kty=\u003e'oct')\n        A128GCMKW           string (raw octects) 16 bytes (or perl HASH ref with JWK, kty=\u003e'oct')\n        A192GCMKW           string (raw octects) 24 bytes (or perl HASH ref with JWK, kty=\u003e'oct')\n        A256GCMKW           string (raw octects) 32 bytes (or perl HASH ref with JWK, kty=\u003e'oct')\n        PBES2-HS256+A128KW  string (raw octects) of any length (or perl HASH ref with JWK, kty=\u003e'oct')\n        PBES2-HS384+A192KW  string (raw octects) of any length (or perl HASH ref with JWK, kty=\u003e'oct')\n        PBES2-HS512+A256KW  string (raw octects) of any length (or perl HASH ref with JWK, kty=\u003e'oct')\n        RSA-OAEP            public RSA key, perl HASH ref with JWK key structure,\n                            a reference to SCALAR string with PEM or DER or JSON/JWK data,\n                            an instance of Crypt::PK::RSA or Crypt::OpenSSL::RSA\n        RSA-OAEP-256        public RSA key, see RSA-OAEP\n        RSA1_5              public RSA key, see RSA-OAEP\n        ECDH-ES             public ECC or X25519 key, perl HASH ref with JWK key structure,\n                            a reference to SCALAR string with PEM or DER or JSON/JWK data,\n                            an instance of Crypt::PK::ECC\n        ECDH-ES+A128KW      public ECC or X25519 key, see ECDH-ES\n        ECDH-ES+A192KW      public ECC or X25519 key, see ECDH-ES\n        ECDH-ES+A256KW      public ECC or X25519 key, see ECDH-ES\n\n- keypass\n\n    When 'key' parameter is an encrypted private RSA or ECC key this optional parameter may contain a password for private key decryption.\n\n- allow\\_none\n\n    `1` - allow JWS with `none` 'alg' header value (which means that token has no signature), **BEWARE: DANGEROUS, UNSECURE!!!**\n\n    `0` (default) - do not allow JWS with `none` 'alg' header value\n\n- extra\\_headers\n\n    This optional parameter may contain a HASH ref with items that will be added to JWT header.\n\n    If you want to use PBES2-based 'alg' like `PBES2-HS512+A256KW` you can set PBES2 salt len (p2s) in bytes and\n    iteration count (p2c) via `extra_headers` like this:\n\n        my $token = encode_jwt(payload=\u003e$p, key=\u003e$k, alg=\u003e'PBES2-HS512+A256KW', extra_headers=\u003e{p2c=8000, p2s=\u003e32});\n        #NOTE: handling of p2s header is a special case, in the end it is replaced with the generated salt\n\n    You can also use this to specify a kid value (see [\"kid\\_keys\"](#kid_keys))\n\n        my $token = encode_jwt(payload=\u003e$p, key=\u003e$k, alg =\u003e 'RS256', extra_headers=\u003e{kid=\u003e'key1'});\n\n- unprotected\\_headers\n\n    A hash with additional integrity unprotected headers - JWS and JWE (not available for `compact` serialization);\n\n- shared\\_unprotected\\_headers\n\n    A hash with additional integrity unprotected headers - JWE only (not available for `compact` serialization);\n\n- aad\n\n    Additional Authenticated Data - scalar value with any (even raw octects) data - JWE only (not available for `compact` serialization);\n\n- serialization\n\n    Specify serialization method: `compat` (= default) for Compact JWS/JWE serialization or `flattened` for Flattened JWS/JWE JSON serialization.\n\n    General JSON serialization is not supported yet.\n\n- zip\n\n    Compression method, currently 'deflate' is the only one supported. `undef` (default) means no compression.\n\n        my $token = encode_jwt(payload=\u003e$p, key=\u003e$k, alg=\u003e'HS256', zip=\u003e'deflate');\n        #or define compression level\n        my $token = encode_jwt(payload=\u003e$p, key=\u003e$k, alg=\u003e'HS256', zip=\u003e['deflate', 9]);\n\n- auto\\_iat\n\n    `1` - set 'iat' (Issued At) claim to current time (epoch seconds since 1970) at the moment of token encoding\n\n    `0` (default) - do not set 'iat' claim\n\n    NOTE: claims are part of the payload and can be used only if the payload is a HASH ref!\n\n- relative\\_exp\n\n    Set 'exp' claim (Expiration Time) to current time + `relative_exp` value (in seconds).\n\n    NOTE: claims are part of the payload and can be used only if the payload is a HASH ref!\n\n- relative\\_nbf\n\n    Set 'nbf' claim (Not Before) to current time + `relative_nbf` value (in seconds).\n\n    NOTE: claims are part of the payload and can be used only if the payload is a HASH ref!\n\n# SEE ALSO\n\n[Crypt::Cipher::AES](https://metacpan.org/pod/Crypt%3A%3ACipher%3A%3AAES), [Crypt::AuthEnc::GCM](https://metacpan.org/pod/Crypt%3A%3AAuthEnc%3A%3AGCM), [Crypt::PK::RSA](https://metacpan.org/pod/Crypt%3A%3APK%3A%3ARSA), [Crypt::PK::ECC](https://metacpan.org/pod/Crypt%3A%3APK%3A%3AECC), [Crypt::KeyDerivation](https://metacpan.org/pod/Crypt%3A%3AKeyDerivation), [Crypt::KeyWrap](https://metacpan.org/pod/Crypt%3A%3AKeyWrap)\n\n# LICENSE\n\nThis program is free software; you can redistribute it and/or modify it under the same terms as Perl itself.\n\n# COPYRIGHT\n\nCopyright (c) 2015-2025 DCIT, a.s. [https://www.dcit.cz](https://www.dcit.cz) / Karel Miko\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FDCIT%2Fperl-Crypt-JWT","html_url":"https://awesome.ecosyste.ms/projects/github.com%2FDCIT%2Fperl-Crypt-JWT","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FDCIT%2Fperl-Crypt-JWT/lists"}