# @arcblock/jwt

> JSON Web Token variant for arcblock DID solutions

Latest version **1.30.24** (published 2026-05-14) · Apache-2.0 license · 0 weekly downloads

## Install

```sh
npm install @arcblock/jwt
pnpm add @arcblock/jwt
yarn add @arcblock/jwt
bun add @arcblock/jwt
```

## Health

**Score 60/100 (C)** — status: active.

Positive: has types; esm support; no vulnerabilities; high quality score.

Warnings: low downloads.

## Facts

| | |
|---|---|
| Version | 1.30.24 |
| Published | 2026-05-14 |
| First published | 2021-10-28 |
| Weekly downloads | 0 |
| License | Apache-2.0 |
| TypeScript types | bundled |
| Module format | ESM + CommonJS |
| Dependencies | 5 |
| Unpacked size | 46.8 KB |
| Known vulnerabilities | 0 |
| Install scripts | no |
| Author | wangshijun |
| Maintainers | wangshijun, polunzh, mave99a, gxw |
| Keywords | blockchain, arcblock, sdk, nodejs |

## Links

- npm: https://www.npmjs.com/package/@arcblock/jwt
- Repository: https://github.com/ArcBlock/blockchain.git#master
- Homepage: https://github.com/ArcBlock/blockchain/tree/master/did/jwt
- Issues: https://github.com/ArcBlock/blockchain/issues
- npm.io page: https://npm.io/package/@arcblock/jwt

## Dependencies (5)

- [debug](https://npm.io/package/debug.md) ^4.4.3
- [@ocap/util](https://npm.io/package/@ocap/util.md) 1.30.24
- [@arcblock/did](https://npm.io/package/@arcblock/did.md) 1.30.24
- [@ocap/mcrypto](https://npm.io/package/@ocap/mcrypto.md) 1.30.24
- [fast-json-stable-stringify](https://npm.io/package/fast-json-stable-stringify.md) ^2.1.0

## Alternatives

- [jsforce](https://npm.io/package/jsforce.md) — 851.2K weekly downloads
- [react-native-qrcode-svg](https://npm.io/package/react-native-qrcode-svg.md) — 693.5K weekly downloads
- [@salesforce/plugin-data](https://npm.io/package/@salesforce/plugin-data.md) — 394.9K weekly downloads
- [@backstage/plugin-search-common](https://npm.io/package/@backstage/plugin-search-common.md) — 308.5K weekly downloads
- [@chain-registry/types](https://npm.io/package/@chain-registry/types.md) — 38.4K weekly downloads

## Recent versions

- 1.30.24 (latest) — 2026-05-14
- 1.30.23 — 2026-05-13
- 1.30.22 — 2026-05-13
- 1.30.21 — 2026-05-12
- 1.30.20 — 2026-05-12
- 1.30.19 — 2026-05-12
- 1.30.18 — 2026-05-11
- 1.30.17 — 2026-05-11
- 1.30.16 — 2026-05-10
- 1.30.15 — 2026-05-08
- 1.30.14 — 2026-05-08
- 1.30.13 — 2026-05-08
- 1.30.12 — 2026-05-05
- 1.30.11 — 2026-05-03
- 1.30.10 — 2026-04-22
- … 414 more at https://npm.io/package/@arcblock/jwt/versions

## README

![arcblock-jwt](https://www.arcblock.io/.netlify/functions/badge/?text=arcblock-jwt)

[![docs](https://img.shields.io/badge/powered%20by-arcblock-green.svg)](https://docs.arcblock.io)
[![Gitter](https://badges.gitter.im/ArcBlock/community.svg)](https://gitter.im/ArcBlock/community?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge)

This library aims to ease the process of handling `Did-Auth` process between different parts, its implemented according to [ABT-DID-Protocol](https://github.com/ArcBlock/abt-did-spec), and can eliminate the threat of middle-man attach if properly used, there are typically 2 use case for the library:

- `dApp <--> dApp`: for inter application communication, we provide `AppAuthenticator` and `AppHandlers`
- `dApp <--> DID Wallet`: for application and wallet communication, we provide `WalletAuthenticator` and `WalletHandlers`

## Table of Contents

- [Table of Contents](#table-of-contents)
- [Install](#install)
- [Usage](#usage)
  - [Between dApp and DID Wallet](#between-dapp-and-did-wallet)
  - [Between dApp and dApp](#between-dapp-and-dapp)
    - [Initialize authenticator and handlers](#initialize-authenticator-and-handlers)
    - [For the server](#for-the-server)
    - [For the client](#for-the-client)

## Install

```sh
npm install @arcblock/jwt
// or
bun install @arcblock/jwt
```

## Usage

### Between dApp and DID Wallet

`WalletAuthenticator` and `WalletHandlers` should be used together with [@ocap/react-forge](https://www.npmjs.com/package/@ocap/react-forge).

```js
const { fromRandom } = require('@ocap/wallet');
const { WalletAuthenticator, WalletHandlers } = require('@arcblock/jwt');

// First setup authenticator and handler factory
const wallet = fromRandom().toJSON();
const authenticator = new WalletAuthenticator({
  wallet,
  baseUrl: 'http://wangshijun.natapp1.cc',
  appInfo: {
    description: 'Starter projects to develop web application on forge',
    icon: '/images/logo@2x.png',
    name: 'Forge Web Starter',
  },
  chainInfo: {
    host: 'http://did-workshop.arcblock.co:8210/api',
    id: 'forge',
  },
});

const handlers = new WalletHandlers({
  authenticator,
  tokenStorage: new MongoStorage({ url: process.env.MONGO_URI }),
});

// Then attach handler to express server
const express = require('express');
const app = express();

// This is required if you want to use dynamic baseUrl inference
app.set('trust proxy', true);

handlers.attach({
  prefix: '/api/did',
  action: 'login',
  claims: {
    profile: () => ({
      fields: ['fullName', 'email'],
      description: 'Please provide your name and email to continue',
    }),
  },
  onAuth: async ({ claims, userDid }) => {
    try {
      const profile = claims.find((x) => x.type === 'profile');
      console.info('login.success', { userDid, profile });
    } catch (err) {
      console.error('login.error', err);
    }
  },
});

// Then your app will have 5 api endpoints that can be consumed by AuthComponent
// - `GET /api/did/login/token` create new token
// - `GET /api/did/login/status` check for token status
// - `GET /api/did/login/timeout` expire a token
// - `GET /api/did/login/auth` create auth response
// - `POST /api/did/login/auth` process login request
```

### Between dApp and dApp

Please note that `AppAuthenticator` and `AppHandlers` should be used to sign and verify the message sent between dApps, so there must are both a client and a server.

#### Initialize authenticator and handlers

```js
const { fromRandom } = require('@ocap/wallet');
const { AppAuthenticator, AppHandlers } = require('@arcblock/jwt');

// First setup authenticator and handler factory
const wallet = fromRandom().toJSON();
const authenticator = new AppAuthenticator(wallet);
const handlers = new AppHandlers(authenticator);
```

#### For the server

```js
const express = require('express');
const app = express();

app.post('/api/endpoint', handlers.attach(), (req, res) => {
  console.log('client.appPk', req.appPk);
  console.log('verified payload', req.payload);

  // Sent signed response: sensitive info should not be here
  res.jsonSecure({
    key: 'value',
  });
});
```

#### For the client

```js
const axios = require('axios');

const signedPayload = authenticator.sign({
  amount,
  depositorDid,
  depositorPk,
  withdrawer: appAuth.wallet.address,
  merchantId: process.env.MERCHANT_ID,
});

const res = await axios.post('http://example.com/api/endpoint', signedPayload);
const payload = await authenticator.verify(res.data);
if (payload.error) {
  throw new Error(payload.error);
}
// Do something with the payload
```

---
_Source: https://npm.io/package/@arcblock/jwt · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._