# `Jwt`

A signed token: three parts joined by `.`.

Use it for a token you receive. `crypto.verify_jwt` checks it and gives its [`JwtClaims`](/docs/types/type-jwt-claims.md). Don't read one without checking it.

## Shape

One secret value, with no parts.

## Example

```jadpo
var example: Jwt = Jwt("eyJhbGciOiJFZERTQSJ9.RXhhbXBsZSBvZiBFZDI1NTE5IHNpZ25pbmc.hgyY0il_MGCjP0JzlnLWG1PPOt7-09PGcvMg3AIbQR6dWbhijcNR4ki4iylGjg5BhVsPt9g7sVvpAr_MuM0KAg")
assert example == example
```

In a real app it arrives from outside, such as in a request, rather than as text you write in your code.

`text.parse(raw, as: Jwt)` reads one from text that comes from outside. Text that isn't one at all fails `malformed`.

## Good to know

- It is a secret, so it is never sent, logged, stored or shown.
- A token with no signature is refused.
- `==` tells you whether two are the same. `<` and `list.sort_by` don't take it.

## In JSON

A string when it arrives, and written redacted when it leaves, in a request, a response or `json.write`:

```json
"<redacted Jwt>"
```

## Details

<details>
<summary>Text form, storage, how it is shown, and operations</summary>

`Jwt` is in the group Security, and has been in Jadpo since 0.1.0.

### Text form

`text.parse` reads one from its text as it is typed. `text.from` and `text.format` don't take it, so nothing writes it.

### How it is stored

It is never stored.

### How it is shown to people

`text.format` doesn't take it: a `Jwt` is never shown.

### Operations

- `crypto.verify_jwt(token: Jwt, keys: List<Jwk>, issuer: Text?, audience: Text?, as: Type?) -> JwtClaims`: The registered claims of `token` once it holds: signed by one of `keys` with that key's own algorithm (Ed25519, RS256 for an RSA key, ES256 for a P-256 key), never the one the token names, so `none` and every other algorithm fail `invalid_signature`; not expired, not used before its `nbf` and not issued later than now, against the clock with 30 seconds' leeway (`expired`, `not_yet_valid`); issued by `issuer` when one is given (`wrong_issuer`); and for `audience`, or for no audience when none is given (`wrong_audience`). A token that isn't one, or has no `exp`, is `malformed`. With `as:`, an object type of the application's, it gives instead the token's claims the type names, read as `json.read` reads it, a registered one as `JwtClaims` holds it, and fails `mismatch` when they aren't the type. It reads the clock, so it is called only in actions.

It also takes `text.parse`, `json.read`, `json.write` and `==`. [How every standard type behaves](/docs/every-standard-type-meets-one-contract.md) says how they work.

</details>