jwt

JWT toolkit

JWT signing and verification support both the legacy flat config and optional resource-gated rules.

• If Rules is omitted, behavior is unchanged.
• Resource-gated rules use JWT aud.
• Rules can override the default algorithm and key material for selected audiences, for example mcp -> HS256.
• JWKS-style public key discovery should expose RSA keys from the default profile and any RSA rule profiles, but never HMAC keys.

Example config:

{
  "JWTValidator": {
    "RSA": [
      {
        "Key": "blowfish://default",
        "URL": "/opt/datly/jwt/public.enc"
      }
    ],
    "Rules": [
      {
        "Resource": ["mcp"],
        "Algorithm": "HS256",
        "HMAC": {
          "Key": "blowfish://default",
          "URL": "/opt/datly/jwt/mcp_hmac.enc"
        }
      }
    ]
  },
  "JwtSigner": {
    "RSA": {
      "Key": "blowfish://default",
      "URL": "/opt/datly/jwt/private.enc"
    },
    "Rules": [
      {
        "Resource": ["mcp"],
        "Algorithm": "HS256",
        "HMAC": {
          "Key": "blowfish://default",
          "URL": "/opt/datly/jwt/mcp_hmac.enc"
        }
      }
    ]
  }
}

Signing and verifying JWT token with custom RSA key

1. Generating RSA key: `

# Created Private key
ssh-keygen -t rsa -f key.pem -m pem 
or 
openssl genpkey -out private.txt -outform PEM -algorithm RSA -pkeyopt rsa_keygen_bits:4096
#  Created public key with:
openssl pkey -inform PEM -outform PEM -in private.txt -pubout -out public.txt

1. Secure rsa.json with scy client (use one of the supported security store)

    scy -m=secure -s=public.txt -d=public.scy -t=raw -k=blowfish://default ## on prod, use secure store instead of local fs
    scy -m=secure -s=private.txt -d=private.scy -t=raw -k=blowfish://default ## on prod, use secure store instead of local fs
   

2. To sign JWT Claim a) Creates jwt Claim in JSON format

   echo '{"user_id":123,"email":"dev@viantinc.com"}' > claims.json 

b) Sign claim

   scy -m=signJwt -s=claims.json -e=600 -r=private.scy -k=blowfish://default

1. To verify JWT Claim scy -m=verifyJwt -s=token.json -r=public.scy -k=blowfish://default