Jwt Tcl Reference Documentation
Jwt
Current Version: 11.5.0
Chilkat.Jwt
Build JWTs from JSON header and payload data, then sign them using the
algorithm and key material required by the application or API.
Decode the JWT header and payload without verification when an
application needs to inspect claims, algorithms, key IDs, or token
metadata.
Verify JWT signatures using HMAC shared secrets, RSA public keys, ECC
public keys, or certificates.
Create tokens using shared secrets, private keys, or certificates that
have access to the associated private key.
Validate
Use JWTs for bearer-token style authentication, service-account flows,
assertion-based OAuth flows, and other compact token formats.
For an extended overview, see
Jwt Class Overview.
Create, decode, verify, and time-validate compact JSON Web Tokens.
Chilkat.Jwt is the Chilkat class for working with compact JSON
Web Tokens. It can create signed JWTs, decode JWT headers and payloads,
verify signatures, validate time-based claims, generate NumericDate values,
and work with HMAC shared-secret tokens, RSA public/private-key tokens,
ECC public/private-key tokens, and certificate-backed signing workflows.
Create compact JWTs
Decode headers and claims
Verify signatures
Sign with keys or certs
Time validation
exp and nbf claims and generate
NumericDate values for token expiration, not-before, and issued-at
timestamps.
API authentication workflows
iss, sub, aud, iat,
nbf, or exp, then sign with the required shared
secret, private key, or certificate. To consume a JWT, decode it as needed,
verify the signature with the matching key, and separately validate the
time-based claims required by the application.
Object Creation
# 'this' is not a keyword in Tcl. It can freely be used as a variable name. set this [new CkJwt]
Properties
AutoCompact
set boolVal [CkJwt_get_AutoCompact $this]
CkJwt_put_AutoCompact $this $boolVal
Controls whether Chilkat removes insignificant JSON whitespace from the header and payload passed to CreateJwt and CreateJwtPk before Base64URL encoding and signing. The default is 1.
Compaction reduces token size without changing the JSON data model. Because the exact header and payload bytes are part of the signing input, changing this property changes the encoded token and its signature even when the JSON values are equivalent.
DebugLogFilePath
# ckStr is a CkString
CkJwt_get_DebugLogFilePath $this $ckStr
set strVal [CkJwt_get_debugLogFilePath $this]
CkJwt_put_DebugLogFilePath $this $strVal
If set to a file path, this property logs the LastErrorText of each Chilkat method or property call to the specified file. This logging helps identify the context and history of Chilkat calls leading up to any crash or hang, aiding in debugging.
Enabling the VerboseLogging property provides more detailed information. This property is mainly used for debugging rare instances where a Chilkat method call causes a hang or crash, which should generally not happen.
Possible causes of hangs include:
- A timeout property set to 0, indicating an infinite timeout.
- A hang occurring within an event callback in the application code.
- An internal bug in the Chilkat code causing the hang.
LastErrorHtml
# ckStr is a CkString
CkJwt_get_LastErrorHtml $this $ckStr
set strVal [CkJwt_get_lastErrorHtml $this]
Provides HTML-formatted information about the last called method or property. If a method call fails or behaves unexpectedly, check this property for details. Note that information is available regardless of the method call's success.
topLastErrorText
# ckStr is a CkString
CkJwt_get_LastErrorText $this $ckStr
set strVal [CkJwt_get_lastErrorText $this]
Provides plain text information about the last called method or property. If a method call fails or behaves unexpectedly, check this property for details. Note that information is available regardless of the method call's success.
LastErrorXml
# ckStr is a CkString
CkJwt_get_LastErrorXml $this $ckStr
set strVal [CkJwt_get_lastErrorXml $this]
Provides XML-formatted information about the last called method or property. If a method call fails or behaves unexpectedly, check this property for details. Note that information is available regardless of the method call's success.
topLastMethodSuccess
set boolVal [CkJwt_get_LastMethodSuccess $this]
CkJwt_put_LastMethodSuccess $this $boolVal
Indicates the success or failure of the most recent method call: 1 means success, 0 means failure. This property remains unchanged by property setters or getters. This method is present to address challenges in checking for null or Nothing returns in certain programming languages. Note: This property does not apply to methods that return integer values or to boolean-returning methods where the boolean does not indicate success or failure.
UncommonOptions
# ckStr is a CkString
CkJwt_get_UncommonOptions $this $ckStr
set strVal [CkJwt_get_uncommonOptions $this]
CkJwt_put_UncommonOptions $this $strVal
Provides a catch-all string for specialized compatibility options that are not exposed as ordinary properties. The default is the empty string, which is appropriate for normal use.
Utf8
set boolVal [CkJwt_get_Utf8 $this]
CkJwt_put_Utf8 $this $boolVal
When set to 1, all string arguments and return values are interpreted as UTF-8 strings. When set to 0, they are interpreted as ANSI strings.
In Chilkat v11.0.0 and later, the default value is 1. Before v11.0.0, it was 0.
VerboseLogging
set boolVal [CkJwt_get_VerboseLogging $this]
CkJwt_put_VerboseLogging $this $boolVal
If set to 1, then the contents of LastErrorText (or LastErrorXml, or LastErrorHtml) may contain more verbose information. The default value is 0. Verbose logging should only be used for debugging. The potentially large quantity of logged information may adversely affect peformance.
Version
# ckStr is a CkString
CkJwt_get_Version $this $ckStr
set strVal [CkJwt_get_version $this]
Methods
CreateJwt
# payload is a string
# password is a string
# outStr is a CkString (output)
set status [CkJwt_CreateJwt $this $header $payload $password $outStr]
set retStr [CkJwt_createJwt $this $header $payload $password]
Creates a signed JWT using an HMAC shared secret. header may be a complete JOSE header JSON object or the shorthand HS256, HS384, or HS512. A shorthand value produces a standard header containing the corresponding alg value.
payload is the JSON claims set. Chilkat signs the JSON supplied by the application; it does not automatically add claims such as iss, sub, aud, iat, nbf, or exp. password is the shared secret used by both the signer and verifier.
| Algorithm | Operation |
|---|---|
HS256 | HMAC with SHA-256. |
HS384 | HMAC with SHA-384. |
HS512 | HMAC with SHA-512. |
On success, the result is a compact JWS in the form base64url(header).base64url(payload).base64url(signature). The Base64URL segments do not use padding.
CreateJwtPk when the trust model requires an asymmetric private key.Returns 1 for success, 0 for failure.
CreateJwtCert
# payload is a string
# cert is a CkCert
# outStr is a CkString (output)
set status [CkJwt_CreateJwtCert $this $header $payload $cert $outStr]
set retStr [CkJwt_createJwtCert $this $header $payload $cert]
Creates a signed JWT using the private key associated with cert. The certificate must provide access to an RSA or EC private key compatible with the alg value in header.
header may be a complete JOSE header JSON object or the shorthand RS256, RS384, RS512, PS256, PS384, PS512, ES256, ES384, or ES512. payload is the JSON claims set. PS256/384/512 support was added in Chilkat v10.0.0.
On success, the result is a compact JWS in the form base64url(header).base64url(payload).base64url(signature).
Returns 1 for success, 0 for failure.
CreateJwtPk
# payload is a string
# key is a CkPrivateKey
# outStr is a CkString (output)
set status [CkJwt_CreateJwtPk $this $header $payload $key $outStr]
set retStr [CkJwt_createJwtPk $this $header $payload $key]
Creates a signed JWT using an asymmetric private key. header may be a complete JOSE header JSON object or one of the documented shorthand algorithm names. payload is the JSON claims set, and key must be a private key compatible with the selected alg.
| JOSE algorithm | Required key and signature scheme |
|---|---|
RS256, RS384, RS512 | RSA private key; RSASSA-PKCS1-v1_5 with the corresponding SHA-2 digest. |
PS256, PS384, PS512 | RSA private key; RSASSA-PSS with the corresponding SHA-2 digest and MGF1. |
ES256, ES384, ES512 | EC private key compatible with the requested ECDSA algorithm. |
EdDSA | Ed25519 private key. Use a full JOSE header containing "alg":"EdDSA". |
The shorthand forms documented for this method are RS256, RS384, RS512, PS256, PS384, PS512, ES256, ES384, and ES512. PS256/384/512 support was added in Chilkat v10.0.0; Ed25519 signing with EdDSA requires Chilkat v9.5.0.95 or later.
On success, the result is a compact JWS in the form base64url(header).base64url(payload).base64url(signature).
alg. Do not select an algorithm solely from untrusted input. Choose the algorithm as part of the application protocol and use a key intended for that algorithm.Returns 1 for success, 0 for failure.
GenNumericDate
set retInt [CkJwt_GenNumericDate $this $numSecOffset]
Returns a JWT NumericDate equal to the current system time plus numSecOffset. The result is the number of whole seconds elapsed since 1970-01-01T00:00:00Z, ignoring leap seconds.
A positive offset produces a future time and a negative offset produces a past time. Typical uses include generating values for iat, nbf, and exp claims. The method returns the numeric value only; it does not insert the value into a JSON payload.
GetHeader
# outStr is a CkString (output)
set status [CkJwt_GetHeader $this $token $outStr]
set retStr [CkJwt_getHeader $this $token]
Decodes and returns the JOSE header JSON from the first segment of the compact JWT. For a token in the form header.payload.signature, this method Base64URL-decodes the header segment and interprets it as JSON text.
VerifyJwt or VerifyJwtPk succeeds, treat every header value—including alg, kid, jku, and x5u—as attacker-controlled input.The method fails if the token does not contain a decodable compact-JWT header.
Returns 1 for success, 0 for failure.
GetPayload
# outStr is a CkString (output)
set status [CkJwt_GetPayload $this $token $outStr]
set retStr [CkJwt_getPayload $this $token]
Decodes and returns the claims-set JSON from the second segment of the compact JWT. For a token in the form header.payload.signature, this method Base64URL-decodes the payload segment and returns the resulting JSON text.
The method fails if the token does not contain a decodable compact-JWT payload.
Returns 1 for success, 0 for failure.
IsTimeValid
# leeway is an integer
set retBool [CkJwt_IsTimeValid $this $jwt $leeway]
Checks the JWT exp (expiration time) and nbf (not before) claims against the current system time. It returns 1 when every present time constraint permits the token to be used, and 0 when the token is expired, is not yet valid, or its relevant time data cannot be processed.
| Claim | Validity rule |
|---|---|
exp | The token is not accepted on or after the expiration time. |
nbf | The token is not accepted before the not-before time. |
leeway is a number of seconds allowed for clock skew. Keep it small; a few minutes is typical. The method checks whichever of exp and nbf are present and does not require either claim to exist.
IsTimeValid does not verify the JWT signature and does not validate iss, aud, sub, iat, jti, nonce values, or application-specific claims. A normal validation workflow verifies the signature, checks time constraints, and then validates all required claims.VerifyJwt
# password is a string
set status [CkJwt_VerifyJwt $this $token $password]
Verifies the signature of a compact JWT signed with the shared secret in password. This method accepts only the HMAC algorithms HS256, HS384, and HS512. It rejects none and algorithms intended for asymmetric keys.
Chilkat reads the token's alg value, computes the corresponding HMAC over the encoded header and payload, and compares the result with the signature segment. The method returns 1 only when the signature matches.
IsTimeValid and perform the application's required claim checks separately.Returns 1 for success, 0 for failure.
VerifyJwtPk
# key is a CkPublicKey
set status [CkJwt_VerifyJwtPk $this $token $key]
Verifies the signature of a compact JWT using key. The public key must match the private key that created the signature and must be compatible with the algorithm named by the token's alg header.
| JOSE algorithm | Verification key |
|---|---|
RS256, RS384, RS512 | RSA public key for RSASSA-PKCS1-v1_5. |
PS256, PS384, PS512 | RSA public key for RSASSA-PSS. |
ES256, ES384, ES512 | EC public key compatible with the ECDSA algorithm. |
EdDSA | Ed25519 public key. Ed25519 verification requires Chilkat v9.5.0.84 or later. |
The method returns 1 only when the signature is valid. It returns 0 for a malformed token, unsupported or incompatible algorithm/key combination, incorrect key, or invalid signature. The unsecured none algorithm is rejected.
Returns 1 for success, 0 for failure.