JwtCodec class final

Signs and verifies JWTs (RFC 7519) with a key ring.

The first key signs; verification picks the key by kid when present, otherwise tries every key of the token's algorithm — which is what makes rotation painless: add the new key first, keep the old one for a while.

Constructors

JwtCodec({required List<JwtKey> keys, Duration leeway = const Duration(seconds: 30), String? issuer, String? audience, DateTime clock()?})

JwtCodec.hs256(String secret, {Duration leeway = const Duration(seconds: 30), String? issuer, String? audience})

HS256 with one secret (JWT_SECRET).

factory

Properties

audience → String?

When set, aud is added on sign and required on verify.

final

hashCode → int

The hash code for this object.

no setter, inherited

issuer → String?

When set, iss is added on sign and required on verify.

final

keys → List<JwtKey>

final

leeway → Duration

Clock skew tolerated for exp/nbf/iat.

final

runtimeType → Type

A representation of the runtime type of the object.

no setter, inherited

Methods

noSuchMethod(Invocation invocation) → dynamic

Invoked when a nonexistent method or property is accessed.

inherited

sign(Map<String, Object?> claims, {JwtKey? key}) → Future<String>

Signs claims. Missing iat is filled in; iss/aud are added from the codec configuration when absent.

toString() → String

A string representation of this object.

inherited

verify(String token) → Future<JwtClaims>

Verifies signature and time claims; throws JwtException otherwise.

Operators

operator ==(Object other) → bool

The equality operator.

inherited

Static Methods

decodeUnverified(String token) → ({Map<String, Object?> header, Map<String, Object?> payload})

Decodes header and payload without verifying anything.