sigil-jwt

A Sigil library for creating and verifying JSON Web Tokens (JWT) with HMAC-SHA256 signatures.

Features

• Token creation -- sign claims with HS256
• Token verification -- validate signature and expiration
• Unsafe decoding -- inspect claims without verification (e.g. to select the correct key)
• Automatic timestamps -- iat injected at creation, exp checked at decode

Usage

Add sigil-jwt as a dependency in your package.sgl:

(from-git url: "codeberg:sigil/sigil-jwt" package: "sigil-jwt")

Then create and verify tokens:

(import (sigil jwt))

;; Create a signed token
(define token (jwt-encode '((sub . "user123")
                            (exp . 1735689600))
                          "my-secret"))

;; Verify and decode
(define claims (jwt-decode token "my-secret"))
;; => ((sub . "user123") (exp . 1735689600) (iat . ...))

;; Decode without verification
(define claims (jwt-decode-unsafe token))

Dependencies

• sigil-stdlib
• sigil-json
• sigil-fp

Building

sigil deps install
sigil build
sigil test

License

BSD-3-Clause