shomei-jwt: JWT access-token signing/verification and JWKS publishing
Interprets Shōmei's signing-key effects with jose. Signs and verifies ES256 (or, configurably, RS256) access tokens and OpenID Connect ID tokens, publishes the JWKS document that relying services fetch to verify those tokens offline, and implements key rotation with an overlap window so a retired key keeps verifying outstanding tokens until they expire. Depends only on shomei-core, so it can be used without Shōmei's HTTP or PostgreSQL layers.
Downloads
- shomei-jwt-0.2.0.0.tar.gz [browse] (Cabal source package)
- Package description (as included in the package)
Maintainer's Corner
For package maintainers and hackage trustees
Candidates
| Versions [RSS] | 0.2.0.0 |
|---|---|
| Change log | CHANGELOG.md |
| Dependencies | aeson (>=2.1 && <2.3), base (>=4.18 && <5), base64-bytestring (>=1.2 && <1.3), bytestring (>=0.11 && <0.13), containers (>=0.6 && <0.9), crypton (>=1.1.0 && <1.2), effectful (>=2.5 && <2.8), effectful-core (>=2.5 && <2.8), jose (>=0.13 && <0.14), lens (>=5.2 && <5.4), monad-time (>=0.4 && <0.5), mtl (>=2.3 && <2.4), ram (>=0.22 && <0.23), shomei-core (>=0.2.0.0 && <0.3), text (>=2.0 && <2.2), time (>=1.12 && <1.15) [details] |
| Tested with | ghc ==9.12.4 |
| License | MIT |
| Copyright | 2026 Nadeem Bitar |
| Author | Nadeem Bitar |
| Maintainer | nadeem@gmail.com |
| Uploaded | by shinzui at 2026-08-28T04:44:21Z |
| Category | Web, Security |
| Home page | https://github.com/shinzui/shomei |
| Bug tracker | https://github.com/shinzui/shomei/issues |
| Source repo | head: git clone https://github.com/shinzui/shomei.git |
| Distributions | |
| Downloads | 3 total (3 in the last 30 days) |
| Rating | (no votes yet) [estimated by Bayesian average] |
| Your Rating | |
| Status | Docs uploaded by user Build status unknown [no reports yet] |