keylab

Create, sign, verify, and inspect JSON Web Tokens with PEM, JWK, and JWKS support. keylab runs in Node.js, Cloudflare Workers, browsers, and Bun, including portable support for curves that modern jose no longer handles directly.

Install

bun add keylab

npm install keylab

yarn add keylab

Quick start

import {
  getKeyPair,
  signJwtWithPrivateKey,
  checkTokenValidness,
  JwtAlgorithmsEnum as Algs,
} from "keylab"

const keyPair = await getKeyPair({
  keyFormat: "jwk",
  algorithmIdentifier: Algs.ES256,
  keySize: 2048,
})

const token = await signJwtWithPrivateKey(
  { sub: "user-123", iss: "https://issuer.example" },
  Algs.ES256,
  keyPair.privateKey,
  { kid: keyPair.kid },
)

const verified = await checkTokenValidness(token, {
  adhoc: [keyPair.publicKey],
})

Prefer JWK for cross-runtime use. PEM for ES256K, Ed448, and X448 still needs Node.js. ML-DSA-44, ML-DSA-65, and ML-DSA-87 are JWK only.

Documentation

• Getting started
• API
• Runtime compatibility
• Portable algorithms
• Migration from jsonwebtoken
• Changelog
• Deep wiki

Contributing

See CONTRIBUTING.md and the Code of Conduct.

Security

Report vulnerabilities privately. See SECURITY.md.

License

MIT. See LICENSE.