Verify a token given a secret or public key.

import Json.Decode
import Json.Encode
import TestHelpers
    exposing
        ( aValidToken
        , correctSecret
        , encodePayload
        , payload
        , payloadDecoder
        , wrongSecret
        )

If all goes well, you'll get a result back with the payload.

decode payloadDecoder correctSecret aValidToken
--> Ok payload

If something goes wrong, you get an error:

decode payloadDecoder correctSecret "token.should.have.three.parts"
--> Err InvalidToken

Some errors will include the payload. However, whenever there is an error the payload should not be trusted.

decode payloadDecoder wrongSecret aValidToken
--> Err <| InvalidSecret payload

Create and sign a token.

import Json.Decode
import Json.Encode
import TestHelpers
    exposing
        ( aValidToken
        , correctSecret
        , encodePayload
        , payload
        , payloadDecoder
        , wrongSecret
        )


encode hmacSha256 encodePayload correctSecret payload
--> aValidToken


encode hmacSha512 Json.Encode.string "other secret" "some payload"
    |> (decode Json.Decode.string "other secret")
--> Ok "some payload"


encode hmacSha224 Json.Encode.int "123" 456
    |> (decode Json.Decode.int "abc")
--> Err <| InvalidSecret 456

Create and sign a token, optionally passing extra values to be included in your JWT header.

import Json.Decode
import Json.Encode
import TestHelpers
    exposing
        ( aValidTokenWithCustomHeaders
        , correctSecret
        , encodePayload
        , payload
        , payloadDecoder
        , wrongSecret
        )


encodeWithHeaders hmacSha256 (\payload -> [ ( "kid", Json.Encode.int payload.iat) ]) encodePayload correctSecret payload
--> aValidTokenWithCustomHeaders

HMAC SHA224 digest algorithm.

HMAC SHA256 digest algorithm.

HMAC SHA384 digest algorithm.

HMAC SHA512 digest algorithm.

Types of errors which can occur during decoding of a token.

Type of algoirthm to use for the digest

String used to sign or verify a token.

• In the case of signing, this can also be a private key.
• In the case of verifying, this can also be a public key.

A JSON web token.

Algorithm decoder.