# jsontokens

> node.js library for encoding, decoding, and verifying JSON Web Tokens (JWTs)

Latest version **4.0.1** (published 2022-08-27) · MIT license · 0 weekly downloads

## Install

```sh
npm install jsontokens
pnpm add jsontokens
yarn add jsontokens
bun add jsontokens
```

## Health

**Score 25/100 (F)** — status: abandoned.

Positive: has types; no vulnerabilities; high quality score.

Warnings: low downloads; no esm support.

Negative: abandoned; low maintenance score.

## Facts

| | |
|---|---|
| Version | 4.0.1 |
| Published | 2022-08-27 |
| First published | 2016-11-29 |
| Weekly downloads | 0 |
| License | MIT |
| TypeScript types | bundled |
| Module format | CommonJS |
| Dependencies | 3 |
| Unpacked size | 119 KB |
| Known vulnerabilities | 0 |
| Install scripts | no |
| GitHub stars | 45 |
| Author | Blockstack PBC |
| Maintainers | zone117x, shea256, blockstack-devops |
| Keywords | jwt, json, web, token, encode, decode, verify, ecdsa, secp256k1, ec, elliptic, curve, signature, sign |

## Links

- npm: https://www.npmjs.com/package/jsontokens
- Repository: https://github.com/stacks-network/jsontokens-js
- Homepage: https://github.com/stacks-network/jsontokens-js#readme
- Issues: https://github.com/stacks-network/jsontokens-js/issues
- npm.io page: https://npm.io/package/jsontokens

## Dependencies (3)

- [base64-js](https://npm.io/package/base64-js.md) ^1.5.1
- [@noble/hashes](https://npm.io/package/@noble/hashes.md) ^1.1.2
- [@noble/secp256k1](https://npm.io/package/@noble/secp256k1.md) ^1.6.3

## Alternatives

- [@mapbox/jsonlint-lines-primitives](https://npm.io/package/@mapbox/jsonlint-lines-primitives.md) — 5.3M weekly downloads
- [reftools](https://npm.io/package/reftools.md) — 3.5M weekly downloads
- [@hey-api/openapi-ts](https://npm.io/package/@hey-api/openapi-ts.md) — 3.5M weekly downloads
- [@mapbox/geojson-rewind](https://npm.io/package/@mapbox/geojson-rewind.md) — 2.4M weekly downloads
- [turbo-stream](https://npm.io/package/turbo-stream.md) — 1.7M weekly downloads

## Recent versions

- 4.0.1 (latest) — 2022-08-27
- 3.0.0-alpha.2 (beta) — 2019-11-15
- 4.0.0 — 2022-08-25
- 3.1.1 — 2022-06-01
- 3.1.0 — 2022-05-31
- 3.0.0 — 2019-12-17
- 3.0.0-alpha.1 — 2019-11-15
- 3.0.0-alpha.0 — 2019-11-05
- 2.0.3-beta.0 — 2019-10-15
- 2.0.2 — 2019-06-25
- 2.0.0 — 2019-06-04
- 1.0.0 — 2018-12-18
- 0.8.0 — 2018-10-02
- 0.7.8 — 2018-05-21
- 0.7.7 — 2018-02-23
- … 11 more at https://npm.io/package/jsontokens/versions

## README

# JSON Tokens JS

[![CircleCI](https://img.shields.io/circleci/project/blockstack/jsontokens-js/master.svg)](https://circleci.com/gh/blockstack/jsontokens-js/tree/master)
[![npm](https://img.shields.io/npm/l/jsontokens.svg)](https://www.npmjs.com/package/jsontokens)
[![npm](https://img.shields.io/npm/v/jsontokens.svg)](https://www.npmjs.com/package/jsontokens)
[![npm](https://img.shields.io/npm/dm/jsontokens.svg)](https://www.npmjs.com/package/jsontokens)
[![Slack](https://img.shields.io/badge/join-slack-e32072.svg?style=flat)](http://slack.blockstack.org/)

node.js library for signing, decoding, and verifying JSON Web Tokens (JWTs) with the ES256K signature scheme (which uses the secp256k elliptic curve). This is currently the only supported signing and verification scheme for this library.

### Installation

```
npm install jsontokens
```

### Signing Tokens

```js
import { TokenSigner } from 'jsontokens'

const rawPrivateKey = '278a5de700e29faae8e40e366ec5012b5ec63d36ec77e8a2417154cc1d25383f'
const tokenPayload = {"iat": 1440713414.85}
const token = new TokenSigner('ES256K', rawPrivateKey).sign(tokenPayload)
```

### Creating Unsecured Tokens

```js
import { createUnsecuredToken } from 'jsontokens'

const unsecuredToken = createUnsecuredToken(tokenPayload)
```

### Decoding Tokens

```js
import { decodeToken } = from 'jsontokens'
const tokenData = decodeToken(token)
```

### Verifying Tokens

The TokenVerifier class will validate that a token is correctly signed. It does not perform checks on the claims in the payload (e.g., the `exp` field)--- checking the expiration field, etc., is left as a requirement for callers.

```js
import { TokenVerifier } from 'jsontokens'
const rawPublicKey = '03fdd57adec3d438ea237fe46b33ee1e016eda6b585c3e27ea66686c2ea5358479'
const verified = new TokenVerifier('ES256K', rawPublicKey).verify(token)
```

### Example Tokens

```text
eyJ0eXAiOiJKV1QiLA0KICJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJqb2UiLA0KICJleHAiOjEzMDA4MTkzODAsDQogImh0dHA6Ly9leGFtcGxlLmNvbS9pc19yb290Ijp0cnVlfQ.dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk
```

---
_Source: https://npm.io/package/jsontokens · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._