Since websh 3.7.8, JWT support is provided by the separate pure-Tcl package jwt (version 1.1) instead of being embedded in websh. Load it with package require jwt; it provides ::jwt::sign, ::jwt::verify (with -json, -claims and -leeway) and the ::jwt::base64url_encode / ::jwt::base64url_decode utilities. See the README of the jwt package for the full documentation. websh itself no longer depends on the nacl and rl_json packages.