object

jwt

Facade predicates for parsing, signing, verifying, and validating JSON Web Tokens.

Availability:
logtalk_load(jwt(loader))
Author: Paulo Moura
Version: 1:0:0
Date: 2026-07-06
Compilation flags:
static, context_switching_calls
Imports:
public jwt_helpers
Uses:
jwt_claims
jwt_compact
jwt_jwa
jwt_jwks
jwt_jws
Remarks:
(none)
Inherited public predicates:
 check_option/1  check_options/1  default_option/1  default_options/1  option/2  option/3  valid_option/1  valid_options/1

Public predicates

decode/3

Decodes a compact JWT into header and claims JSON terms without verifying the signature.

Compilation flags:
static
Template:
decode(Token,Header,Claims)
Mode and number of proofs:
decode(+atom,-term,-term) - one_or_error
Exceptions:
Token is a variable:
instantiation_error
Token is neither a variable nor an atom:
type_error(atom,Token)
Token is an atom but not a valid compact JWT:
domain_error(jwt_compact_serialization,Token)
Token contains Base64URL data with characters outside the Base64URL alphabet:
representation_error(base64)

decode/5

Decodes a compact JWT into header, claims, signature bytes, and signing input.

Compilation flags:
static
Template:
decode(Token,Header,Claims,Signature,SigningInput)
Mode and number of proofs:
decode(+atom,-term,-term,-list(byte),-atom) - one_or_error
Exceptions:
Token is a variable:
instantiation_error
Token is neither a variable nor an atom:
type_error(atom,Token)
Token is an atom but not a valid compact JWT:
domain_error(jwt_compact_serialization,Token)
Token contains Base64URL data with characters outside the Base64URL alphabet:
representation_error(base64)

header/2

Decodes only the JWT header JSON term.

Compilation flags:
static
Template:
header(Token,Header)
Mode and number of proofs:
header(+atom,-term) - one_or_error
Exceptions:
Token is a variable:
instantiation_error
Token is neither a variable nor an atom:
type_error(atom,Token)
Token is an atom but not a valid compact JWT:
domain_error(jwt_compact_serialization,Token)
Token contains Base64URL data with characters outside the Base64URL alphabet:
representation_error(base64)

claims/2

Decodes only the JWT claims JSON term.

Compilation flags:
static
Template:
claims(Token,Claims)
Mode and number of proofs:
claims(+atom,-term) - one_or_error
Exceptions:
Token is a variable:
instantiation_error
Token is neither a variable nor an atom:
type_error(atom,Token)
Token is an atom but not a valid compact JWT:
domain_error(jwt_compact_serialization,Token)
Token contains Base64URL data with characters outside the Base64URL alphabet:
representation_error(base64)

claim/3

Looks up a claim value by name in a claims JSON term.

Compilation flags:
static
Template:
claim(Claims,Name,Value)
Mode and number of proofs:
claim(+term,+atom,-term) - zero_or_one

peek_algorithm/2

Decodes the JWT header and returns its algorithm.

Compilation flags:
static
Template:
peek_algorithm(Token,Algorithm)
Mode and number of proofs:
peek_algorithm(+atom,-atom) - one_or_error
Exceptions:
Token is a variable:
instantiation_error
Token is neither a variable nor an atom:
type_error(atom,Token)
Token is an atom but not a valid compact JWT:
domain_error(jwt_compact_serialization,Token)
Token contains Base64URL data with characters outside the Base64URL alphabet:
representation_error(base64)
The decoded JWT header does not contain a valid alg member:
domain_error(jwt_header,Header)

peek_key_id/2

Decodes the JWT header and returns its optional key identifier.

Compilation flags:
static
Template:
peek_key_id(Token,KeyId)
Mode and number of proofs:
peek_key_id(+atom,-atom) - zero_or_one

verify/4

Verifies a compact JWT using a key or JWK Set and returns the claims.

Compilation flags:
static
Template:
verify(Token,KeyOrJWKSet,Claims,Options)
Mode and number of proofs:
verify(+atom,+term,-term,+list(compound)) - zero_or_one_or_error
Exceptions:
Options is a variable or a partial list:
instantiation_error
Options is neither a variable nor a list:
type_error(list,Options)
An element Option of the list Options is neither a variable nor a compound term:
type_error(compound,Option)
An element Option of the list Options is a compound term but not a valid option:
domain_error(option,Option)
Token is a variable:
instantiation_error
Token is neither a variable nor an atom:
type_error(atom,Token)
Token is an atom but not a valid compact JWT:
domain_error(jwt_compact_serialization,Token)
Token contains Base64URL data with characters outside the Base64URL alphabet:
representation_error(base64)
The decoded JWT header does not contain a valid alg member:
domain_error(jwt_header,Header)
The JWT algorithm is unsupported or disallowed:
domain_error(jwt_algorithm,Algorithm)
KeyOrJWKSet is not a JSON Web Key Set with a keys list:
domain_error(jwt_jwks,KeyOrJWKSet)
No compatible key exists for the JWT header:
existence_error(jwt_jwk,Header)
KeyOrJWKSet is not a valid symmetric key:
domain_error(jwt_symmetric_key,KeyOrJWKSet)
KeyOrJWKSet is not a supported public JWK:
domain_error(jwt_jwk_public_key,KeyOrJWKSet)
The ES256 signature is not 64 bytes long:
domain_error(jwt_es256_signature,Signature)
The OpenSSL executable does not exist:
existence_error(os_command,Executable)
A required claim is missing:
domain_error(jwt_claims,missing(Name))
A claim has an invalid value:
domain_error(jwt_claim(Name),Value)
A time claim value is not a number:
type_error(time_number,Name-Time)

verify/5

Verifies a compact JWT using a key or JWK Set and returns the header and claims.

Compilation flags:
static
Template:
verify(Token,Header,Claims,KeyOrJWKSet,Options)
Mode and number of proofs:
verify(+atom,-term,-term,+term,+list(compound)) - zero_or_one_or_error
Exceptions:
Options is a variable or a partial list:
instantiation_error
Options is neither a variable nor a list:
type_error(list,Options)
An element Option of the list Options is neither a variable nor a compound term:
type_error(compound,Option)
An element Option of the list Options is a compound term but not a valid option:
domain_error(option,Option)
Token is a variable:
instantiation_error
Token is neither a variable nor an atom:
type_error(atom,Token)
Token is an atom but not a valid compact JWT:
domain_error(jwt_compact_serialization,Token)
Token contains Base64URL data with characters outside the Base64URL alphabet:
representation_error(base64)
The decoded JWT header does not contain a valid alg member:
domain_error(jwt_header,Header)
The JWT algorithm is unsupported or disallowed:
domain_error(jwt_algorithm,Algorithm)
KeyOrJWKSet is not a JSON Web Key Set with a keys list:
domain_error(jwt_jwks,KeyOrJWKSet)
No compatible key exists for the JWT header:
existence_error(jwt_jwk,Header)
KeyOrJWKSet is not a valid symmetric key:
domain_error(jwt_symmetric_key,KeyOrJWKSet)
KeyOrJWKSet is not a supported public JWK:
domain_error(jwt_jwk_public_key,KeyOrJWKSet)
The ES256 signature is not 64 bytes long:
domain_error(jwt_es256_signature,Signature)
The OpenSSL executable does not exist:
existence_error(os_command,Executable)
A required claim is missing:
domain_error(jwt_claims,missing(Name))
A claim has an invalid value:
domain_error(jwt_claim(Name),Value)
A time claim value is not a number:
type_error(time_number,Name-Time)

verify_signature/5

Verifies a JWS signature for a signing input, algorithm, key, and options.

Compilation flags:
static
Template:
verify_signature(Algorithm,SigningInput,Signature,Key,Options)
Mode and number of proofs:
verify_signature(+atom,+atom,+list(byte),+term,+list(compound)) - zero_or_one_or_error
Exceptions:
Options is a variable or a partial list:
instantiation_error
Options is neither a variable nor a list:
type_error(list,Options)
An element Option of the list Options is neither a variable nor a compound term:
type_error(compound,Option)
An element Option of the list Options is a compound term but not a valid option:
domain_error(option,Option)
Algorithm is unsupported or disallowed:
domain_error(jwt_algorithm,Algorithm)
Key is not a valid symmetric key:
domain_error(jwt_symmetric_key,Key)
Key is not a supported public JWK:
domain_error(jwt_jwk_public_key,Key)
Signature is not a 64-byte raw ES256 signature:
domain_error(jwt_es256_signature,Signature)
The OpenSSL executable does not exist:
existence_error(os_command,Executable)

sign/5

Signs claims as a compact JWT using the given header, key, and options.

Compilation flags:
static
Template:
sign(Header,Claims,Key,Token,Options)
Mode and number of proofs:
sign(+term,+term,+term,-atom,+list(compound)) - one_or_error
Exceptions:
Options is a variable or a partial list:
instantiation_error
Options is neither a variable nor a list:
type_error(list,Options)
An element Option of the list Options is neither a variable nor a compound term:
type_error(compound,Option)
An element Option of the list Options is a compound term but not a valid option:
domain_error(option,Option)
Header does not contain a valid alg member:
domain_error(jwt_header,Header)
The JWT algorithm is unsupported or disallowed:
domain_error(jwt_algorithm,Algorithm)
Header or Claims cannot be encoded as JSON:
domain_error(json_sink,HeaderOrClaims)
Key is not a valid symmetric key:
domain_error(jwt_symmetric_key,Key)
Algorithm is not a supported signing algorithm:
domain_error(jwt_signing_algorithm,Algorithm)

sign_payload/5

Signs a payload JSON term as a compact JWS using the given header, key, and options.

Compilation flags:
static
Template:
sign_payload(Header,Payload,Key,Token,Options)
Mode and number of proofs:
sign_payload(+term,+term,+term,-atom,+list(compound)) - one_or_error
Exceptions:
Options is a variable or a partial list:
instantiation_error
Options is neither a variable nor a list:
type_error(list,Options)
An element Option of the list Options is neither a variable nor a compound term:
type_error(compound,Option)
An element Option of the list Options is a compound term but not a valid option:
domain_error(option,Option)
Header does not contain a valid alg member:
domain_error(jwt_header,Header)
The JWT algorithm is unsupported or disallowed:
domain_error(jwt_algorithm,Algorithm)
Header or Payload cannot be encoded as JSON:
domain_error(json_sink,HeaderOrPayload)
Key is not a valid symmetric key:
domain_error(jwt_symmetric_key,Key)
Algorithm is not a supported signing algorithm:
domain_error(jwt_signing_algorithm,Algorithm)

validate_claims/3

Validates JWT claims using registered-claim defaults, a policy list, and options.

Compilation flags:
static
Template:
validate_claims(Claims,Policy,Options)
Mode and number of proofs:
validate_claims(+term,+list(compound),+list(compound)) - one_or_error
Exceptions:
Options is a variable or a partial list:
instantiation_error
Options is neither a variable nor a list:
type_error(list,Options)
An element Option of the list Options is neither a variable nor a compound term:
type_error(compound,Option)
An element Option of the list Options is a compound term but not a valid option:
domain_error(option,Option)
A required claim is missing:
domain_error(jwt_claims,missing(Name))
A claim has an invalid value:
domain_error(jwt_claim(Name),Value)
Policy contains an invalid claim policy:
domain_error(jwt_claim_policy,Policy)
A time claim value is not a number:
type_error(time_number,Name-Time)
Policy contains an invalid time-claim kind:
domain_error(jwt_time_claim_kind,Kind)

validate_claim/3

Validates a single JWT claim policy against a claims JSON term.

Compilation flags:
static
Template:
validate_claim(Claims,ClaimPolicy,Options)
Mode and number of proofs:
validate_claim(+term,+compound,+list(compound)) - one_or_error
Exceptions:
A required claim is missing:
domain_error(jwt_claims,missing(Name))
A claim has an invalid value:
domain_error(jwt_claim(Name),Value)
ClaimPolicy is not a valid claim policy:
domain_error(jwt_claim_policy,ClaimPolicy)
A time claim value is not a number:
type_error(time_number,Name-Time)
ClaimPolicy contains an invalid time-claim kind:
domain_error(jwt_time_claim_kind,Kind)

Protected predicates

(no local declarations; see entity ancestors if any)

Private predicates

(no local declarations; see entity ancestors if any)

Operators

(none)