shomei-jwt: JWT access-token signing/verification and JWKS publishing

[ library, mit, security, web ] [ Propose Tags ] [ Report a vulnerability ]

Interprets Shōmei's signing-key effects with jose. Signs and verifies ES256 (or, configurably, RS256) access tokens and OpenID Connect ID tokens, publishes the JWKS document that relying services fetch to verify those tokens offline, and implements key rotation with an overlap window so a retired key keeps verifying outstanding tokens until they expire. Depends only on shomei-core, so it can be used without Shōmei's HTTP or PostgreSQL layers.

Downloads

Maintainer's Corner

Package maintainers

For package maintainers and hackage trustees

Candidates

Versions [RSS] 0.2.0.0
Change log CHANGELOG.md
Dependencies aeson (>=2.1 && <2.3), base (>=4.18 && <5), base64-bytestring (>=1.2 && <1.3), bytestring (>=0.11 && <0.13), containers (>=0.6 && <0.9), crypton (>=1.1.0 && <1.2), effectful (>=2.5 && <2.8), effectful-core (>=2.5 && <2.8), jose (>=0.13 && <0.14), lens (>=5.2 && <5.4), monad-time (>=0.4 && <0.5), mtl (>=2.3 && <2.4), ram (>=0.22 && <0.23), shomei-core (>=0.2.0.0 && <0.3), text (>=2.0 && <2.2), time (>=1.12 && <1.15) [details]
Tested with ghc ==9.12.4
License MIT
Copyright 2026 Nadeem Bitar
Author Nadeem Bitar
Maintainer nadeem@gmail.com
Uploaded by shinzui at 2026-08-28T04:44:21Z
Category Web, Security
Home page https://github.com/shinzui/shomei
Bug tracker https://github.com/shinzui/shomei/issues
Source repo head: git clone https://github.com/shinzui/shomei.git
Distributions
Downloads 3 total (3 in the last 30 days)
Rating (no votes yet) [estimated by Bayesian average]
Your Rating
  • λ
  • λ
  • λ
Status Docs uploaded by user
Build status unknown [no reports yet]