The compiled-in ::jwt namespace provides JWT
signing and verification. It requires the external C packages
nacl and rl_json (loaded
on first use). Algorithms are selected via the header field
alg: HS256 (default),
HS512, or NaCl. Secrets
are normalized to 32 bytes (zero-padded or truncated).
::jwt::sign header payload secret
header and
payload are JSON text. Returns the
signed token
header.payload.signature (base64url).
::jwt::verify token secret ?-json? ?-claims? ?-leeway sec?
Without options, returns a boolean (true /
false); this is a signature check only, the
time claims exp and nbf
are not evaluated.
With -claims, the RFC 7519 time claims are
additionally validated: a signature-valid token is rejected
when not yet active (nbf in the future) or
expired (exp in the past). Absent claims
are not enforced. -leeway
sec adds a clock-skew
tolerance to both checks (default 0; only effective together
with -claims).
With -json, an rl_json
document is returned instead of a boolean. The fields
header and payload hold
the raw JSON text as string values (re-parsable), the field
verify is a boolean. When
-claims is also given, an additional field
reason is present with one of
ok, signature,
notbefore, expired, or
payload. Read a claim in two steps:
set res [::jwt::verify $tok $secret -claims -json] set claims [json get $res payload] ;# raw JSON text json get $claims sub