{"id":19163227,"url":"https://github.com/oada/jwt-bearer-client-auth","last_synced_at":"2025-05-07T11:21:50.624Z","repository":{"id":29825323,"uuid":"33369857","full_name":"OADA/jwt-bearer-client-auth","owner":"OADA","description":"Create and verify JWT bearer client assertions from the oauth-jwt-bearer RFC","archived":false,"fork":false,"pushed_at":"2023-03-15T10:05:05.000Z","size":4195,"stargazers_count":5,"open_issues_count":5,"forks_count":0,"subscribers_count":8,"default_branch":"master","last_synced_at":"2025-04-19T21:25:47.620Z","etag":null,"topics":["jwk","jwt-bearer"],"latest_commit_sha":null,"homepage":"","language":"TypeScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":"olefb/android_kernel_sony_msm8994","license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/OADA.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":"AUTHORS","dei":null,"publiccode":null,"codemeta":null}},"created_at":"2015-04-03T15:40:20.000Z","updated_at":"2023-03-12T14:03:48.000Z","dependencies_parsed_at":"2024-06-19T10:00:16.791Z","dependency_job_id":"a6116b40-281d-428c-9656-a301cef446ee","html_url":"https://github.com/OADA/jwt-bearer-client-auth","commit_stats":{"total_commits":31,"total_committers":3,"mean_commits":"10.333333333333334","dds":0.4193548387096774,"last_synced_commit":"217e4fe6bd3f3ff22357a2f275b623dbbe63f8a6"},"previous_names":[],"tags_count":12,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/OADA%2Fjwt-bearer-client-auth","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/OADA%2Fjwt-bearer-client-auth/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/OADA%2Fjwt-bearer-client-auth/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/OADA%2Fjwt-bearer-client-auth/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/OADA","download_url":"https://codeload.github.com/OADA/jwt-bearer-client-auth/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":252866123,"owners_count":21816397,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["jwk","jwt-bearer"],"created_at":"2024-11-09T09:14:32.769Z","updated_at":"2025-05-07T11:21:50.601Z","avatar_url":"https://github.com/OADA.png","language":"TypeScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# jwt-bearer-client-auth\n\n[![npm](https://img.shields.io/npm/v/jwt-bearer-client-auth)](https://www.npmjs.com/package/jwt-bearer-client-auth)\n[![Downloads/week](https://img.shields.io/npm/dw/jwt-bearer-client-auth.svg)](https://npmjs.org/package/jwt-bearer-client-auth)\n[![Build Status](https://travis-ci.org/OADA/jwt-bearer-client-auth.svg?branch=master)](https://travis-ci.org/OADA/jwt-bearer-client-auth)\n[![Coverage Status](https://coveralls.io/repos/OADA/jwt-bearer-client-auth/badge.svg?branch=master)](https://coveralls.io/r/OADA/jwt-bearer-client-auth?branch=master)\n[![Dependency Status](https://david-dm.org/oada/jwt-bearer-client-auth.svg)](https://david-dm.org/oada/jwt-bearer-client-auth)\n[![code style: prettier](https://img.shields.io/badge/code_style-prettier-ff69b4.svg)](https://github.com/prettier/prettier)\n[![License](https://img.shields.io/github/license/OADA/jwt-bearer-client-auth)](LICENSE)\n\nCreate and verify RS256 based JWT OAUTH-JWT-bearer client authentications.\n\n## Installation\n\n```shell\nyarn add jwt-bearer-client-auth\n```\n\n## Import Usage\n\n```typescript\nimport { generate, verify } from 'jwt-bearer-client-auth';\n```\n\n## API\n\n### `generate({key, issuer, clientId, tokenEndpoint, expiresIn, payload, options})`\n\nGenerate a valid [jwt-bearer][jwt-bearer] client assertion from client details and the\nclient's private RSA256 key.\n\n#### Parameters\n\n`key` _{PEM JWK}_ The key used to sign the assertion. Currently, the only\nsupported key type is \"PEM JWK\". If the JWK has a `kid` property it will be\nincluded in the client assertion header.\n\n`issuer` _{String}_ An \"unique identifier for the entity that issued the JWT.\"\nA good choice for a client generating assertions on the fly might be the client's\nOAuth 2.0 client ID.\n\n`clientId` _{String}_ The client's OAuth 2.0 client ID. It is the required value\nfor the JWT's `sub` claim.\n\n`tokenEndpoint` _{String}_ The OAuth 2.0 authorization server's token endpoint.\nIt is the required value for the JWT's `aud` claim.\n\n`expiresIn` _{Number}_ The number of seconds from now in which the client\nassertion expires.\n\n`payload` _{Object}_ The properties of this object will be included in the\nJWT's claim body.\n\n`options` _{Object}_ The `options` parameter is passed directly to\n[node-jsonwebtoken][auth0/node-jsonwebtoken]. This module will not allow the\ncaller to override the properties required by the [jwt-bearer][jwt-bearer] RFC.\n\n#### Usage Example\n\n```typescript\n// Generate a jwt-bearer client assertion\n\nimport fs from 'node:fs/promises';\n\nimport { generate } from 'jwt-bearer-client-auth';\n\nconst key = {\n  kid: 'abc123',\n  kty: 'PEM',\n  pem: await fs.readFile('abc123.private.pem'),\n};\nconst issuer = 'aksdfj2w3';\nconst clientId = 'ocjvS38kjxfa3JFXal342';\nconst tokenEndpoint = 'https://api.example.org/token';\nconst expiresIn = 60;\nconst payload: {\n  jti: 'zkjfa3i13';\n};\n\nconst assertion = await generate({\n  key,\n  issuer,\n  clientId,\n  tokenEndpoint,\n  expiresIn,\n  payload,\n});\n```\n\n### `verify({token, hint, issuer, clientId, tokenEndpoint, payload})`\n\nVerify the given `assertion` is a valid [jwt-bearer][jwt-bearer] client\nassertion.\n\n#### Returned Value\n\nA payload promise is returned, but a traditional `function(err, valid)` callback\nis also supported.\n\n#### Parameters\n\n`token` _{JWT}_ The token which is being verified as a valid JWT-bearer client\nassertion.\n\n`hint` _{JWK/JWKS/JWK URI/false}_ This is passed directly to the\n[jwks-utils][jwks-utils] `jwkForSignature` method. It can be:\n\n- The JWK for the token\n- A JWKS in which the tokens JWK is stored (by key id, `kid`)\n- A URI for a JWKS in which the tokens JWK is stored (by key id, `kid`)\n- Or, `false`, indicating that the key is stored within the token's header\n  under either the `jwk` or `jku` property (note this can be easily be\n  spoofed and the key should be verified by other means before trusting it).\n\n`issuer` _{String}_ An \"unique identifier for the entity that issued the JWT.\"\nA good choice for a client generating assertions on the fly might be the client's\nOAuth 2.0 client ID.\n\n`clientId` _{String}_ The client's OAuth 2.0 client ID. It is the required value\nfor the JWT's `sub` claim.\n\n`tokenEndpoint` _{String}_ The OAuth 2.0 authorization server's token endpoint.\nIt is the required value for the JWT's `aud` claim.\n\n`payload` _{Object}_ Extra payload claims (and acceptable values) the caller\nrequires to be included in the token to verify the assertion.\n\n#### Usage Example\n\n```typescript\n// Verify a jwt-bearer-client-auth client assertion\n\nimport { verify } from 'jwt-bearer-client-auth';\n\nconst assertion = getClientAssertion();\nconst key = getPublicKey();\nconst issuer = getIssuer();\nconst clientId = getClientId();\nconst tokenEndpoint = getTokenEndpoint();\nconst options = {\n  jti: 'xjkaf3xz',\n};\n\ntry {\n  const payload = await verify({\n    assertion,\n    key,\n    issuer,\n    clientId,\n    tokenEndpoint,\n    options,\n  });\n  console.log('Client assertion validated');\n} catch (error: unknown) {\n  console.error(err, 'Client assertion was not validated');\n}\n```\n\n[jwt-bearer]: https://tools.ietf.org/id/draft-ietf-oauth-jwt-bearer.txt\n[node-jsonwebtoken]: https://github.com/auth0/node-jsonwebtoken\n[jwks-utils]: https://github.com/oada/node-jwks-utils\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Foada%2Fjwt-bearer-client-auth","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Foada%2Fjwt-bearer-client-auth","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Foada%2Fjwt-bearer-client-auth/lists"}