`(sigil jwt)`

(sigil jwt) - JSON Web Token Library

Create and verify JWT tokens for authentication.

Creating tokens

(import (sigil jwt))

(define token (jwt-encode '((sub . "user123")
                            (email . "user@example.com"))
                          "my-secret-key"))

Verifying tokens

(let ((claims (jwt-decode token "my-secret-key")))
  (if claims
      (display (assoc-ref 'sub claims))
      (display "Invalid token")))

Exports

jwt-encodeprocedure

Create a signed JWT token from claims.

Claims should be an alist of claim names to values. Common claims: sub - Subject (user ID) iat - Issued at (Unix timestamp, added automatically) exp - Expiration (Unix timestamp) email, username, etc.

Returns a JWT string in the format: header.payload.signature

Examples:

(jwt-encode '((sub . "12345") (email . "user@example.com"))
            "secret-key")
; => "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."

jwt-decodeprocedure

Decode and verify a JWT token.

Returns the claims as a dict if the signature is valid, or #f if invalid. Also checks the exp claim if present and rejects expired tokens.

Examples:

(jwt-decode "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." "secret-key")
; => #{ sub: "12345" email: "user@example.com" iat: 1234567890 }

(jwt-decode "invalid.token.here" "secret-key")
; => #f

jwt-decode-unsafeprocedure

Decode a JWT without verifying the signature.

Use this only when you need to inspect token claims before verification (e.g., to determine which secret to use). NEVER trust these claims for authentication.

Returns the claims as a dict, or #f if the token is malformed.