object

# `jwt`

Facade predicates for parsing, signing, verifying, and validating JSON Web Tokens.

Availability:
`logtalk_load(jwt(loader))`
Author: Paulo Moura
Version: 1:0:0
Date: 2026-07-06
Compilation flags:
`static, context_switching_calls`
Imports:
`public` jwt_helpers
Uses:
jwt_claims
jwt_compact
jwt_jwa
jwt_jwks
jwt_jws
Remarks:
(none)
Inherited public predicates:
check_option/1 check_options/1 default_option/1 default_options/1 option/2 option/3 valid_option/1 valid_options/1

## Public predicates

### `decode/3`

Decodes a compact JWT into header and claims JSON terms without verifying the signature.

Compilation flags:
`static`
Template:
`decode(Token,Header,Claims)`
Mode and number of proofs:
`decode(+atom,-term,-term)` - `one_or_error`
Exceptions:
`Token` is a variable:
`instantiation_error`
`Token` is neither a variable nor an atom:
`type_error(atom,Token)`
`Token` is an atom but not a valid compact JWT:
`domain_error(jwt_compact_serialization,Token)`
`Token` contains Base64URL data with characters outside the Base64URL alphabet:
`representation_error(base64)`

### `decode/5`

Decodes a compact JWT into header, claims, signature bytes, and signing input.

Compilation flags:
`static`
Template:
`decode(Token,Header,Claims,Signature,SigningInput)`
Mode and number of proofs:
`decode(+atom,-term,-term,-list(byte),-atom)` - `one_or_error`
Exceptions:
`Token` is a variable:
`instantiation_error`
`Token` is neither a variable nor an atom:
`type_error(atom,Token)`
`Token` is an atom but not a valid compact JWT:
`domain_error(jwt_compact_serialization,Token)`
`Token` contains Base64URL data with characters outside the Base64URL alphabet:
`representation_error(base64)`

### `header/2`

Decodes only the JWT header JSON term.

Compilation flags:
`static`
Template:
`header(Token,Header)`
Mode and number of proofs:
`header(+atom,-term)` - `one_or_error`
Exceptions:
`Token` is a variable:
`instantiation_error`
`Token` is neither a variable nor an atom:
`type_error(atom,Token)`
`Token` is an atom but not a valid compact JWT:
`domain_error(jwt_compact_serialization,Token)`
`Token` contains Base64URL data with characters outside the Base64URL alphabet:
`representation_error(base64)`

### `claims/2`

Decodes only the JWT claims JSON term.

Compilation flags:
`static`
Template:
`claims(Token,Claims)`
Mode and number of proofs:
`claims(+atom,-term)` - `one_or_error`
Exceptions:
`Token` is a variable:
`instantiation_error`
`Token` is neither a variable nor an atom:
`type_error(atom,Token)`
`Token` is an atom but not a valid compact JWT:
`domain_error(jwt_compact_serialization,Token)`
`Token` contains Base64URL data with characters outside the Base64URL alphabet:
`representation_error(base64)`

### `claim/3`

Looks up a claim value by name in a claims JSON term.

Compilation flags:
`static`
Template:
`claim(Claims,Name,Value)`
Mode and number of proofs:
`claim(+term,+atom,-term)` - `zero_or_one`

### `peek_algorithm/2`

Decodes the JWT header and returns its algorithm.

Compilation flags:
`static`
Template:
`peek_algorithm(Token,Algorithm)`
Mode and number of proofs:
`peek_algorithm(+atom,-atom)` - `one_or_error`
Exceptions:
`Token` is a variable:
`instantiation_error`
`Token` is neither a variable nor an atom:
`type_error(atom,Token)`
`Token` is an atom but not a valid compact JWT:
`domain_error(jwt_compact_serialization,Token)`
`Token` contains Base64URL data with characters outside the Base64URL alphabet:
`representation_error(base64)`
The decoded JWT header does not contain a valid `alg` member:
`domain_error(jwt_header,Header)`

### `peek_key_id/2`

Decodes the JWT header and returns its optional key identifier.

Compilation flags:
`static`
Template:
`peek_key_id(Token,KeyId)`
Mode and number of proofs:
`peek_key_id(+atom,-atom)` - `zero_or_one`

### `verify/4`

Verifies a compact JWT using a key or JWK Set and returns the claims.

Compilation flags:
`static`
Template:
`verify(Token,KeyOrJWKSet,Claims,Options)`
Mode and number of proofs:
`verify(+atom,+term,-term,+list(compound))` - `zero_or_one_or_error`
Exceptions:
`Options` is a variable or a partial list:
`instantiation_error`
`Options` is neither a variable nor a list:
`type_error(list,Options)`
An element `Option` of the list `Options` is neither a variable nor a compound term:
`type_error(compound,Option)`
An element `Option` of the list `Options` is a compound term but not a valid option:
`domain_error(option,Option)`
`Token` is a variable:
`instantiation_error`
`Token` is neither a variable nor an atom:
`type_error(atom,Token)`
`Token` is an atom but not a valid compact JWT:
`domain_error(jwt_compact_serialization,Token)`
`Token` contains Base64URL data with characters outside the Base64URL alphabet:
`representation_error(base64)`
The decoded JWT header does not contain a valid `alg` member:
`domain_error(jwt_header,Header)`
The JWT algorithm is unsupported or disallowed:
`domain_error(jwt_algorithm,Algorithm)`
`KeyOrJWKSet` is not a JSON Web Key Set with a `keys` list:
`domain_error(jwt_jwks,KeyOrJWKSet)`
No compatible key exists for the JWT header:
`existence_error(jwt_jwk,Header)`
`KeyOrJWKSet` is not a valid symmetric key:
`domain_error(jwt_symmetric_key,KeyOrJWKSet)`
`KeyOrJWKSet` is not a supported public JWK:
`domain_error(jwt_jwk_public_key,KeyOrJWKSet)`
The ES256 signature is not 64 bytes long:
`domain_error(jwt_es256_signature,Signature)`
The OpenSSL executable does not exist:
`existence_error(os_command,Executable)`
A required claim is missing:
`domain_error(jwt_claims,missing(Name))`
A claim has an invalid value:
`domain_error(jwt_claim(Name),Value)`
A time claim value is not a number:
`type_error(time_number,Name-Time)`

### `verify/5`

Verifies a compact JWT using a key or JWK Set and returns the header and claims.

Compilation flags:
`static`
Template:
`verify(Token,Header,Claims,KeyOrJWKSet,Options)`
Mode and number of proofs:
`verify(+atom,-term,-term,+term,+list(compound))` - `zero_or_one_or_error`
Exceptions:
`Options` is a variable or a partial list:
`instantiation_error`
`Options` is neither a variable nor a list:
`type_error(list,Options)`
An element `Option` of the list `Options` is neither a variable nor a compound term:
`type_error(compound,Option)`
An element `Option` of the list `Options` is a compound term but not a valid option:
`domain_error(option,Option)`
`Token` is a variable:
`instantiation_error`
`Token` is neither a variable nor an atom:
`type_error(atom,Token)`
`Token` is an atom but not a valid compact JWT:
`domain_error(jwt_compact_serialization,Token)`
`Token` contains Base64URL data with characters outside the Base64URL alphabet:
`representation_error(base64)`
The decoded JWT header does not contain a valid `alg` member:
`domain_error(jwt_header,Header)`
The JWT algorithm is unsupported or disallowed:
`domain_error(jwt_algorithm,Algorithm)`
`KeyOrJWKSet` is not a JSON Web Key Set with a `keys` list:
`domain_error(jwt_jwks,KeyOrJWKSet)`
No compatible key exists for the JWT header:
`existence_error(jwt_jwk,Header)`
`KeyOrJWKSet` is not a valid symmetric key:
`domain_error(jwt_symmetric_key,KeyOrJWKSet)`
`KeyOrJWKSet` is not a supported public JWK:
`domain_error(jwt_jwk_public_key,KeyOrJWKSet)`
The ES256 signature is not 64 bytes long:
`domain_error(jwt_es256_signature,Signature)`
The OpenSSL executable does not exist:
`existence_error(os_command,Executable)`
A required claim is missing:
`domain_error(jwt_claims,missing(Name))`
A claim has an invalid value:
`domain_error(jwt_claim(Name),Value)`
A time claim value is not a number:
`type_error(time_number,Name-Time)`

### `verify_signature/5`

Verifies a JWS signature for a signing input, algorithm, key, and options.

Compilation flags:
`static`
Template:
`verify_signature(Algorithm,SigningInput,Signature,Key,Options)`
Mode and number of proofs:
`verify_signature(+atom,+atom,+list(byte),+term,+list(compound))` - `zero_or_one_or_error`
Exceptions:
`Options` is a variable or a partial list:
`instantiation_error`
`Options` is neither a variable nor a list:
`type_error(list,Options)`
An element `Option` of the list `Options` is neither a variable nor a compound term:
`type_error(compound,Option)`
An element `Option` of the list `Options` is a compound term but not a valid option:
`domain_error(option,Option)`
`Algorithm` is unsupported or disallowed:
`domain_error(jwt_algorithm,Algorithm)`
`Key` is not a valid symmetric key:
`domain_error(jwt_symmetric_key,Key)`
`Key` is not a supported public JWK:
`domain_error(jwt_jwk_public_key,Key)`
`Signature` is not a 64-byte raw ES256 signature:
`domain_error(jwt_es256_signature,Signature)`
The OpenSSL executable does not exist:
`existence_error(os_command,Executable)`

### `sign/5`

Signs claims as a compact JWT using the given header, key, and options.

Compilation flags:
`static`
Template:
`sign(Header,Claims,Key,Token,Options)`
Mode and number of proofs:
`sign(+term,+term,+term,-atom,+list(compound))` - `one_or_error`
Exceptions:
`Options` is a variable or a partial list:
`instantiation_error`
`Options` is neither a variable nor a list:
`type_error(list,Options)`
An element `Option` of the list `Options` is neither a variable nor a compound term:
`type_error(compound,Option)`
An element `Option` of the list `Options` is a compound term but not a valid option:
`domain_error(option,Option)`
`Header` does not contain a valid `alg` member:
`domain_error(jwt_header,Header)`
The JWT algorithm is unsupported or disallowed:
`domain_error(jwt_algorithm,Algorithm)`
`Header` or `Claims` cannot be encoded as JSON:
`domain_error(json_sink,HeaderOrClaims)`
`Key` is not a valid symmetric key:
`domain_error(jwt_symmetric_key,Key)`
`Algorithm` is not a supported signing algorithm:
`domain_error(jwt_signing_algorithm,Algorithm)`

### `sign_payload/5`

Signs a payload JSON term as a compact JWS using the given header, key, and options.

Compilation flags:
`static`
Template:
`sign_payload(Header,Payload,Key,Token,Options)`
Mode and number of proofs:
`sign_payload(+term,+term,+term,-atom,+list(compound))` - `one_or_error`
Exceptions:
`Options` is a variable or a partial list:
`instantiation_error`
`Options` is neither a variable nor a list:
`type_error(list,Options)`
An element `Option` of the list `Options` is neither a variable nor a compound term:
`type_error(compound,Option)`
An element `Option` of the list `Options` is a compound term but not a valid option:
`domain_error(option,Option)`
`Header` does not contain a valid `alg` member:
`domain_error(jwt_header,Header)`
The JWT algorithm is unsupported or disallowed:
`domain_error(jwt_algorithm,Algorithm)`
`Header` or `Payload` cannot be encoded as JSON:
`domain_error(json_sink,HeaderOrPayload)`
`Key` is not a valid symmetric key:
`domain_error(jwt_symmetric_key,Key)`
`Algorithm` is not a supported signing algorithm:
`domain_error(jwt_signing_algorithm,Algorithm)`

### `validate_claims/3`

Validates JWT claims using registered-claim defaults, a policy list, and options.

Compilation flags:
`static`
Template:
`validate_claims(Claims,Policy,Options)`
Mode and number of proofs:
`validate_claims(+term,+list(compound),+list(compound))` - `one_or_error`
Exceptions:
`Options` is a variable or a partial list:
`instantiation_error`
`Options` is neither a variable nor a list:
`type_error(list,Options)`
An element `Option` of the list `Options` is neither a variable nor a compound term:
`type_error(compound,Option)`
An element `Option` of the list `Options` is a compound term but not a valid option:
`domain_error(option,Option)`
A required claim is missing:
`domain_error(jwt_claims,missing(Name))`
A claim has an invalid value:
`domain_error(jwt_claim(Name),Value)`
`Policy` contains an invalid claim policy:
`domain_error(jwt_claim_policy,Policy)`
A time claim value is not a number:
`type_error(time_number,Name-Time)`
`Policy` contains an invalid time-claim kind:
`domain_error(jwt_time_claim_kind,Kind)`

### `validate_claim/3`

Validates a single JWT claim policy against a claims JSON term.

Compilation flags:
`static`
Template:
`validate_claim(Claims,ClaimPolicy,Options)`
Mode and number of proofs:
`validate_claim(+term,+compound,+list(compound))` - `one_or_error`
Exceptions:
A required claim is missing:
`domain_error(jwt_claims,missing(Name))`
A claim has an invalid value:
`domain_error(jwt_claim(Name),Value)`
`ClaimPolicy` is not a valid claim policy:
`domain_error(jwt_claim_policy,ClaimPolicy)`
A time claim value is not a number:
`type_error(time_number,Name-Time)`
`ClaimPolicy` contains an invalid time-claim kind:
`domain_error(jwt_time_claim_kind,Kind)`

## Protected predicates

(no local declarations; see entity ancestors if any)

## Private predicates

(no local declarations; see entity ancestors if any)

## Operators

(none)