# brightspace-auth-validation

> Validate an incoming Brightspace JWT

Latest version **10.0.0** (published 2026-06-24) · Apache-2.0 license · 0 weekly downloads

## Install

```sh
npm install brightspace-auth-validation
pnpm add brightspace-auth-validation
yarn add brightspace-auth-validation
bun add brightspace-auth-validation
```

## Health

**Score 55/100 (C)** — status: active.

Positive: esm support; no vulnerabilities; has provenance.

Warnings: low downloads; no types.

## Facts

| | |
|---|---|
| Version | 10.0.0 |
| Published | 2026-06-24 |
| First published | 2016-01-06 |
| Weekly downloads | 0 |
| License | Apache-2.0 |
| TypeScript types | none |
| Module format | ESM + CommonJS |
| Node | >=20.x |
| Dependencies | 3 |
| Unpacked size | 21.7 KB |
| Known vulnerabilities | 0 |
| Install scripts | no |
| Provenance | attested (GitHub Actions) |
| Author | D2L Corporation |
| Maintainers | d2l-travis-deploy |

## Links

- npm: https://www.npmjs.com/package/brightspace-auth-validation
- Repository: https://github.com/Brightspace/node-auth
- Homepage: https://github.com/Brightspace/node-auth#readme
- Issues: https://github.com/Brightspace/node-auth/issues
- npm.io page: https://npm.io/package/brightspace-auth-validation

## Dependencies (3)

- [jose](https://npm.io/package/jose.md) ^6.0.11
- [brightspace-auth-token](https://npm.io/package/brightspace-auth-token.md) 10.0.0
- [jwk-allowed-algorithms](https://npm.io/package/jwk-allowed-algorithms.md) ^1.0.0

## Recent versions

- 10.0.0 (latest) — 2026-06-24
- 9.0.1 — 2025-05-07
- 8.2.1 — 2022-05-12
- 8.2.0 — 2022-03-24
- 8.1.0 — 2021-08-24
- 8.0.0 — 2020-05-04
- 7.0.1 — 2020-05-01
- 7.0.0 — 2019-05-15
- 6.0.2 — 2018-03-05
- 6.0.1 — 2018-03-01
- 6.0.0 — 2018-01-25
- 5.2.2 — 2017-07-21
- 5.2.1 — 2017-02-13
- 5.2.0 — 2016-03-12
- 5.1.5 — 2016-01-27
- … 1 more at https://npm.io/package/brightspace-auth-validation/versions

## README

# brightspace-auth-validation

## Usage

```js
'use strict';

import http from 'node:http';
import AuthTokenValidator from 'brightspace-auth-validation';

const validator = new AuthTokenValidator();

const server = http
	.createServer((req, res) => {
		validator
			.fromHeaders(req.headers)
			.then(token => {
				// token is a BrightspaceAuthToken instance
				res.statusCode = 201;
				res.end('Hi!\n');
			}, e => {
				console.error(e);
				res.statusCode = e.status || 403;
				res.end('Sorry, can\'t let you in!\n');
			});
	})
	.listen(3000);
```

### API

---

#### `new AuthTokenValidator([Object options])` -> `AuthTokenValidator`

##### Option: issuer `String` _(https://auth.brightspace.com/core)_

You may optionally specify the auth instance to connect to.

```js
...new AuthTokenValidator({ issuer: 'https://auth.brightspace.com/core' });
```

##### Option : maxClockSkew `Number` _(300)_

You may optionally specify the allowed clock skew, in seconds, when validating
time-based claims.

##### Option : maxKeyAge `Number` _(18000)_

_Deprecated soon_

You may optionally specify the length of time, in seconds, to trust a given key
without re-confirmation.

##### Option: name `String`

**Recommended**. You may optionally specify a name to send as part of the user
agent when fetching keys from the issuer. Assists in tracking issues and RCAs.

```js
...new AuthTokenValidator({ name: 'johns-service' })
```

---

#### `.fromHeaders(Object headers)` -> `Promise<BrightspaceAuthToken>`

Given the incoming request headers, will attempt to extract and validate the
authorization signature.

---

#### `.fromSignature(String signature)` -> `Promise<BrightspaceAuthToken>`

Validates an authorization signature.

---

#### `.validateConfiguration()` -> `Promise<True>`

Will attempt to interact with the provided auth instance. Resolves if all is
well, or rejects with an error.

---
_Source: https://npm.io/package/brightspace-auth-validation · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._