[{"data":1,"prerenderedAt":1294},["ShallowReactive",2],{"navigation":3,"-jwt-jws-signing":167,"-jwt-jws-signing-surround":1291},[4,22,78,106,141,148],{"title":5,"path":6,"stem":7,"children":8},"Introduction","\u002Fgetting-started","0.Getting-Started\u002F0.index",[9,10,14,18],{"title":5,"path":6,"stem":7},{"title":11,"path":12,"stem":13},"Installation","\u002Fgetting-started\u002Finstallation","0.Getting-Started\u002F1.installation",{"title":15,"path":16,"stem":17},"Quickstart","\u002Fgetting-started\u002Fquickstart","0.Getting-Started\u002F2.quickstart",{"title":19,"path":20,"stem":21},"Core concepts","\u002Fgetting-started\u002Fcore-concepts","0.Getting-Started\u002F3.core-concepts",{"title":23,"path":24,"stem":25,"children":26,"icon":28},"JWT","\u002Fjwt","1.JWT\u002F0.index",[27,29,52],{"title":23,"path":24,"stem":25,"icon":28},"i-carbon-certificate",{"title":30,"path":31,"stem":32,"children":33,"icon":35},"JWS","\u002Fjwt\u002Fjws","1.JWT\u002F1.JWS\u002F0.index",[34,36,40,44,48],{"title":30,"path":31,"stem":32,"icon":35},"i-carbon-document-signed",{"title":37,"path":38,"stem":39},"Signing","\u002Fjwt\u002Fjws\u002Fsigning","1.JWT\u002F1.JWS\u002F1.signing",{"title":41,"path":42,"stem":43},"Verifying","\u002Fjwt\u002Fjws\u002Fverifying","1.JWT\u002F1.JWS\u002F2.verifying",{"title":45,"path":46,"stem":47},"Multi-signature","\u002Fjwt\u002Fjws\u002Fmulti-signature","1.JWT\u002F1.JWS\u002F3.multi-signature",{"title":49,"path":50,"stem":51},"Algorithms","\u002Fjwt\u002Fjws\u002Falgorithms","1.JWT\u002F1.JWS\u002F4.algorithms",{"title":53,"path":54,"stem":55,"children":56,"icon":58},"JWE","\u002Fjwt\u002Fjwe","1.JWT\u002F2.JWE\u002F0.index",[57,59,63,67,71,75],{"title":53,"path":54,"stem":55,"icon":58},"i-carbon-locked",{"title":60,"path":61,"stem":62},"Encrypting","\u002Fjwt\u002Fjwe\u002Fencrypting","1.JWT\u002F2.JWE\u002F1.encrypting",{"title":64,"path":65,"stem":66},"Decrypting","\u002Fjwt\u002Fjwe\u002Fdecrypting","1.JWT\u002F2.JWE\u002F2.decrypting",{"title":68,"path":69,"stem":70},"Multi-recipient","\u002Fjwt\u002Fjwe\u002Fmulti-recipient","1.JWT\u002F2.JWE\u002F3.multi-recipient",{"title":72,"path":73,"stem":74},"ECDH-ES and end-to-end encryption","\u002Fjwt\u002Fjwe\u002Fecdh-es","1.JWT\u002F2.JWE\u002F4.ecdh-es",{"title":49,"path":76,"stem":77},"\u002Fjwt\u002Fjwe\u002Falgorithms","1.JWT\u002F2.JWE\u002F5.algorithms",{"title":79,"path":80,"stem":81,"children":82,"icon":84},"Examples","\u002Fexamples","10.Examples\u002F0.index",[83,85,90,94,98,102],{"title":79,"path":80,"stem":81,"icon":84},"i-carbon-code-reference",{"title":86,"path":87,"stem":88,"icon":89},"Authentication basics","\u002Fexamples\u002Fauthentication-basics","10.Examples\u002F1.authentication-basics","i-lucide-code",{"title":91,"path":92,"stem":93,"icon":89},"Consuming a JWKS endpoint","\u002Fexamples\u002Fjwks-endpoint","10.Examples\u002F2.jwks-endpoint",{"title":95,"path":96,"stem":97,"icon":89},"Refresh token pattern","\u002Fexamples\u002Frefresh-token-pattern","10.Examples\u002F3.refresh-token-pattern",{"title":99,"path":100,"stem":101,"icon":89},"End-to-end encryption","\u002Fexamples\u002Fend-to-end-encryption","10.Examples\u002F4.end-to-end-encryption",{"title":103,"path":104,"stem":105,"icon":89},"Signed receipts","\u002Fexamples\u002Fsigned-receipts","10.Examples\u002F5.signed-receipts",{"title":107,"path":108,"stem":109,"children":110,"icon":112},"JWK","\u002Fjwk","2.JWK\u002F0.index",[111,113,117,121,125,129,133,137],{"title":107,"path":108,"stem":109,"icon":112},"i-carbon-two-factor-authentication",{"title":114,"path":115,"stem":116},"Generating keys","\u002Fjwk\u002Fgenerating","2.JWK\u002F1.generating",{"title":118,"path":119,"stem":120},"Importing and exporting","\u002Fjwk\u002Fimport-export","2.JWK\u002F2.import-export",{"title":122,"path":123,"stem":124},"PEM conversion","\u002Fjwk\u002Fpem","2.JWK\u002F3.pem",{"title":126,"path":127,"stem":128},"Key wrapping","\u002Fjwk\u002Fwrapping","2.JWK\u002F4.wrapping",{"title":130,"path":131,"stem":132},"Password derivation","\u002Fjwk\u002Fpassword-derivation","2.JWK\u002F5.password-derivation",{"title":134,"path":135,"stem":136},"JWK Sets","\u002Fjwk\u002Fjwk-sets","2.JWK\u002F6.jwk-sets",{"title":138,"path":139,"stem":140},"JWK cache","\u002Fjwk\u002Fcache","2.JWK\u002F7.cache",{"title":142,"path":143,"stem":144,"children":145,"icon":147},"Utilities","\u002Futilities","3.Utilities\u002F0.index",[146],{"title":142,"path":143,"stem":144,"icon":147},"i-carbon-tool-box",{"title":149,"path":150,"stem":151,"children":152,"icon":154},"Adapters","\u002Fadapters","99.Adapters\u002F0.index",[153,155,159,163],{"title":149,"path":150,"stem":151,"icon":154},"i-carbon-plug",{"title":156,"path":157,"stem":158},"H3 sessions","\u002Fadapters\u002Fh3-sessions","99.Adapters\u002F1.h3-sessions",{"title":160,"path":161,"stem":162},"Lifecycle hooks","\u002Fadapters\u002Fhooks","99.Adapters\u002F2.hooks",{"title":164,"path":165,"stem":166},"Lower-level functions","\u002Fadapters\u002Flower-level","99.Adapters\u002F3.lower-level",{"id":168,"title":37,"body":169,"description":178,"extension":1286,"meta":1287,"navigation":1288,"path":38,"seo":1289,"stem":39,"__hash__":1290},"content\u002F1.JWT\u002F1.JWS\u002F1.signing.md",{"type":170,"value":171,"toc":1271},"minimark",[172,202,211,216,345,395,402,406,422,487,497,525,605,616,626,693,739,749,764,768,789,871,879,895,902,916,924,980,990,1002,1006,1012,1066,1079,1083,1216,1240,1244,1267],[173,174,179],"pre",{"className":175,"code":176,"language":177,"meta":178,"style":178},"language-ts shiki shiki-themes github-light github-dark github-dark","sign(payload, key, options?)\n","ts","",[180,181,182],"code",{"__ignoreMap":178},[183,184,187,191,195,199],"span",{"class":185,"line":186},"line",1,[183,188,190],{"class":189},"shcOC","sign",[183,192,194],{"class":193},"slsVL","(payload, key, options",[183,196,198],{"class":197},"so5gQ","?",[183,200,201],{"class":193},")\n",[203,204,205,206,210],"p",{},"Produces a ",[207,208,209],"strong",{},"compact JWS"," — the familiar dotted three-part string.",[212,213,215],"h2",{"id":214},"parameters","Parameters",[217,218,219,235],"table",{},[220,221,222],"thead",{},[223,224,225,229,232],"tr",{},[226,227,228],"th",{},"Name",[226,230,231],{},"Type",[226,233,234],{},"Required?",[236,237,238,254,268,290,306,331],"tbody",{},[223,239,240,246,251],{},[241,242,243],"td",{},[180,244,245],{},"payload",[241,247,248],{},[180,249,250],{},"string | Uint8Array | Record\u003Cstring, unknown>",[241,252,253],{},"Yes",[223,255,256,261,266],{},[241,257,258],{},[180,259,260],{},"key",[241,262,263],{},[180,264,265],{},"CryptoKey | JWSSignJWK | Uint8Array",[241,267,253],{},[223,269,270,275,280],{},[241,271,272],{},[180,273,274],{},"options.alg",[241,276,277],{},[180,278,279],{},"JWSAlgorithm",[241,281,282,283,285,286,289],{},"When ",[180,284,260],{}," has no ",[180,287,288],{},"alg"," hint",[223,291,292,297,303],{},[241,293,294],{},[180,295,296],{},"options.protectedHeader",[241,298,299,302],{},[180,300,301],{},"JWSHeaderParameters"," (extra fields)",[241,304,305],{},"No",[223,307,308,313,329],{},[241,309,310],{},[180,311,312],{},"options.expiresIn",[241,314,315,318,319,322,323,322,326],{},[180,316,317],{},"number | string"," — e.g. ",[180,320,321],{},"\"1h\"",", ",[180,324,325],{},"\"7D\"",[180,327,328],{},"3600",[241,330,305],{},[223,332,333,338,343],{},[241,334,335],{},[180,336,337],{},"options.currentDate",[241,339,340],{},[180,341,342],{},"Date",[241,344,305],{},[203,346,347,350,351,354,355,359,360,362,363,366,367,370,371,374,375,366,378,381,382,384,385,322,388,322,391,394],{},[180,348,349],{},"JWSSignJWK"," narrows the JWK by family: ",[180,352,353],{},"JWK_oct\u003CJWK_HMAC>"," for HMAC, or an asymmetric ",[356,357,358],"em",{},"private"," JWK whose ",[180,361,288],{}," is in the matching signing family (",[180,364,365],{},"RS*","\u002F",[180,368,369],{},"PS*"," for RSA, ",[180,372,373],{},"ES*"," for ECDSA, ",[180,376,377],{},"Ed25519",[180,379,380],{},"EdDSA"," for OKP). A JWK whose ",[180,383,288],{}," points at a non-signing family (",[180,386,387],{},"\"RSA-OAEP\"",[180,389,390],{},"\"A256KW\"",[180,392,393],{},"\"ECDH-ES\"",", …) is rejected at the type level.",[203,396,397,398,401],{},"Returns ",[180,399,400],{},"Promise\u003Cstring>"," — the compact JWS.",[212,403,405],{"id":404},"algorithm-inference","Algorithm inference",[203,407,408,409,411,412,414,415,418,419,421],{},"When the key is a ",[207,410,107],{}," with an ",[180,413,288],{}," field set, unjwt reads it and uses that algorithm. ",[180,416,417],{},"generateJWK()"," always sets ",[180,420,288],{}," for you, so in practice you rarely specify it by hand:",[173,423,426],{"className":175,"code":424,"filename":425,"language":177,"meta":178,"style":178},"const key = await generateJWK(\"HS256\"); \u002F\u002F key.alg === \"HS256\"\nconst token = await sign({ sub: \"u1\" }, key); \u002F\u002F uses HS256 automatically\n","inferred.ts",[180,427,428,460],{"__ignoreMap":178},[183,429,430,433,437,440,443,446,449,453,456],{"class":185,"line":186},[183,431,432],{"class":197},"const",[183,434,436],{"class":435},"suiK_"," key",[183,438,439],{"class":197}," =",[183,441,442],{"class":197}," await",[183,444,445],{"class":189}," generateJWK",[183,447,448],{"class":193},"(",[183,450,452],{"class":451},"sfrk1","\"HS256\"",[183,454,455],{"class":193},"); ",[183,457,459],{"class":458},"sCsY4","\u002F\u002F key.alg === \"HS256\"\n",[183,461,463,465,468,470,472,475,478,481,484],{"class":185,"line":462},2,[183,464,432],{"class":197},[183,466,467],{"class":435}," token",[183,469,439],{"class":197},[183,471,442],{"class":197},[183,473,474],{"class":189}," sign",[183,476,477],{"class":193},"({ sub: ",[183,479,480],{"class":451},"\"u1\"",[183,482,483],{"class":193}," }, key); ",[183,485,486],{"class":458},"\u002F\u002F uses HS256 automatically\n",[203,488,489,490,492,493,496],{},"You must pass ",[180,491,274],{}," ",[207,494,495],{},"explicitly"," in three cases:",[498,499,500,508,519],"ul",{},[501,502,503,504,507],"li",{},"The key is a raw ",[180,505,506],{},"Uint8Array"," (no metadata to infer from).",[501,509,510,511,514,515,518],{},"The key is a ",[180,512,513],{},"CryptoKey"," without algorithm context (rare — ",[180,516,517],{},"generateKey()"," sets the algorithm internally).",[501,520,521,522,524],{},"The JWK has no ",[180,523,288],{}," field.",[173,526,529],{"className":175,"code":527,"filename":528,"language":177,"meta":178,"style":178},"import { base64UrlDecode } from \"unjwt\u002Futils\";\n\nconst rawKey = base64UrlDecode(\"GawgguFyGrWKav7AX4VKUg\", { returnAs: \"uint8array\" });\nconst token = await sign({ sub: \"u1\" }, rawKey, { alg: \"HS256\" });\n","explicit.ts",[180,530,531,548,554,581],{"__ignoreMap":178},[183,532,533,536,539,542,545],{"class":185,"line":186},[183,534,535],{"class":197},"import",[183,537,538],{"class":193}," { base64UrlDecode } ",[183,540,541],{"class":197},"from",[183,543,544],{"class":451}," \"unjwt\u002Futils\"",[183,546,547],{"class":193},";\n",[183,549,550],{"class":185,"line":462},[183,551,553],{"emptyLinePlaceholder":552},true,"\n",[183,555,557,559,562,564,567,569,572,575,578],{"class":185,"line":556},3,[183,558,432],{"class":197},[183,560,561],{"class":435}," rawKey",[183,563,439],{"class":197},[183,565,566],{"class":189}," base64UrlDecode",[183,568,448],{"class":193},[183,570,571],{"class":451},"\"GawgguFyGrWKav7AX4VKUg\"",[183,573,574],{"class":193},", { returnAs: ",[183,576,577],{"class":451},"\"uint8array\"",[183,579,580],{"class":193}," });\n",[183,582,584,586,588,590,592,594,596,598,601,603],{"class":185,"line":583},4,[183,585,432],{"class":197},[183,587,467],{"class":435},[183,589,439],{"class":197},[183,591,442],{"class":197},[183,593,474],{"class":189},[183,595,477],{"class":193},[183,597,480],{"class":451},[183,599,600],{"class":193}," }, rawKey, { alg: ",[183,602,452],{"class":451},[183,604,580],{"class":193},[212,606,608,611,612,615],{"id":607},"expiresin-setting-exp-declaratively",[180,609,610],{},"expiresIn"," — setting ",[180,613,614],{},"exp"," declaratively",[203,617,618,619,621,622,625],{},"Sets the ",[180,620,614],{}," claim relative to ",[180,623,624],{},"iat",":",[173,627,629],{"className":175,"code":628,"language":177,"meta":178,"style":178},"await sign({ sub: \"u1\" }, key, { expiresIn: \"1h\" }); \u002F\u002F exp = iat + 3600\nawait sign({ sub: \"u1\" }, key, { expiresIn: 30 }); \u002F\u002F exp = iat + 30\nawait sign({ sub: \"u1\" }, key, { expiresIn: \"7days\" }); \u002F\u002F exp = iat + 604800\n",[180,630,631,653,673],{"__ignoreMap":178},[183,632,633,636,638,640,642,645,647,650],{"class":185,"line":186},[183,634,635],{"class":197},"await",[183,637,474],{"class":189},[183,639,477],{"class":193},[183,641,480],{"class":451},[183,643,644],{"class":193}," }, key, { expiresIn: ",[183,646,321],{"class":451},[183,648,649],{"class":193}," }); ",[183,651,652],{"class":458},"\u002F\u002F exp = iat + 3600\n",[183,654,655,657,659,661,663,665,668,670],{"class":185,"line":462},[183,656,635],{"class":197},[183,658,474],{"class":189},[183,660,477],{"class":193},[183,662,480],{"class":451},[183,664,644],{"class":193},[183,666,667],{"class":435},"30",[183,669,649],{"class":193},[183,671,672],{"class":458},"\u002F\u002F exp = iat + 30\n",[183,674,675,677,679,681,683,685,688,690],{"class":185,"line":556},[183,676,635],{"class":197},[183,678,474],{"class":189},[183,680,477],{"class":193},[183,682,480],{"class":451},[183,684,644],{"class":193},[183,686,687],{"class":451},"\"7days\"",[183,689,649],{"class":193},[183,691,692],{"class":458},"\u002F\u002F exp = iat + 604800\n",[203,694,695,696,322,699,322,702,322,705,322,707,322,710,322,713,716,717,322,720,322,723,322,726,322,729,322,732,322,735,738],{},"Accepted forms: ",[180,697,698],{},"\"30s\"",[180,700,701],{},"\"10m\"",[180,703,704],{},"\"2h\"",[180,706,325],{},[180,708,709],{},"\"1W\"",[180,711,712],{},"\"3M\"",[180,714,715],{},"\"1Y\""," and the long forms (",[180,718,719],{},"\"seconds\"",[180,721,722],{},"\"minutes\"",[180,724,725],{},"\"hours\"",[180,727,728],{},"\"days\"",[180,730,731],{},"\"weeks\"",[180,733,734],{},"\"months\"",[180,736,737],{},"\"years\"",").",[203,740,741,742,744,745,748],{},"If your payload already has an ",[180,743,624],{},", it's preserved; otherwise the current time is used. Use ",[180,746,747],{},"currentDate"," to override \"now\" in tests.",[750,751,752],"note",{},[203,753,754,756,757,760,761,763],{},[180,755,610],{}," is a signer-side option. On the verifier side, pass ",[180,758,759],{},"maxTokenAge"," or rely on the ",[180,762,614],{}," claim that's already baked into the token.",[212,765,767],{"id":766},"custom-header-parameters","Custom header parameters",[203,769,770,771,774,775,777,778,780,781,784,785,788],{},"Anything passed in ",[180,772,773],{},"protectedHeader"," is merged into the JWS header. ",[180,776,288],{}," is reserved — it's always derived from the top-level ",[180,779,288],{}," option (or inferred from the key) and can't be overridden here. ",[180,782,783],{},"b64"," is user-settable: set it to ",[180,786,787],{},"false"," to opt into the RFC 7797 unencoded-payload mode (see below).",[173,790,793],{"className":175,"code":791,"filename":792,"language":177,"meta":178,"style":178},"const token = await sign({ sub: \"u1\" }, key, {\n  protectedHeader: {\n    kid: \"legacy-2024\", \u002F\u002F overrides key.kid if set\n    typ: \"access+jwt\", \u002F\u002F RFC 8725 guidance — custom type name\n    cty: \"application\u002Fjson\", \u002F\u002F nested-content media type\n  },\n});\n","custom-header.ts",[180,794,795,814,819,832,845,859,865],{"__ignoreMap":178},[183,796,797,799,801,803,805,807,809,811],{"class":185,"line":186},[183,798,432],{"class":197},[183,800,467],{"class":435},[183,802,439],{"class":197},[183,804,442],{"class":197},[183,806,474],{"class":189},[183,808,477],{"class":193},[183,810,480],{"class":451},[183,812,813],{"class":193}," }, key, {\n",[183,815,816],{"class":185,"line":462},[183,817,818],{"class":193},"  protectedHeader: {\n",[183,820,821,824,827,829],{"class":185,"line":556},[183,822,823],{"class":193},"    kid: ",[183,825,826],{"class":451},"\"legacy-2024\"",[183,828,322],{"class":193},[183,830,831],{"class":458},"\u002F\u002F overrides key.kid if set\n",[183,833,834,837,840,842],{"class":185,"line":583},[183,835,836],{"class":193},"    typ: ",[183,838,839],{"class":451},"\"access+jwt\"",[183,841,322],{"class":193},[183,843,844],{"class":458},"\u002F\u002F RFC 8725 guidance — custom type name\n",[183,846,848,851,854,856],{"class":185,"line":847},5,[183,849,850],{"class":193},"    cty: ",[183,852,853],{"class":451},"\"application\u002Fjson\"",[183,855,322],{"class":193},[183,857,858],{"class":458},"\u002F\u002F nested-content media type\n",[183,860,862],{"class":185,"line":861},6,[183,863,864],{"class":193},"  },\n",[183,866,868],{"class":185,"line":867},7,[183,869,870],{"class":193},"});\n",[872,873,875,878],"h3",{"id":874},"kid-fallback",[180,876,877],{},"kid"," fallback",[203,880,881,882,884,885,888,889,891,892,894],{},"If the key is a JWK with a ",[180,883,877],{}," field and you don't set ",[180,886,887],{},"protectedHeader.kid",", unjwt adds ",[180,890,877],{}," to the header automatically. This is the \"make tokens carry their key identity\" behavior — essential for JWKS endpoints and key rotation. An explicit ",[180,893,887],{}," always wins.",[212,896,898,901],{"id":897},"b64-false-rfc-7797-unencoded-payload",[180,899,900],{},"b64: false"," — RFC 7797 unencoded payload",[203,903,904,911,912,915],{},[905,906,910],"a",{"href":907,"rel":908},"https:\u002F\u002Fwww.rfc-editor.org\u002Frfc\u002Frfc7797",[909],"nofollow","RFC 7797"," defines a variant where the JWS payload is signed over ",[207,913,914],{},"raw bytes"," rather than the base64url-encoded form. Useful when:",[498,917,918,921],{},[501,919,920],{},"The payload is already a large or structured document (XML, JSON-LD) that consumers want to read without base64 decoding.",[501,922,923],{},"The payload contains binary data and base64url overhead matters.",[173,925,928],{"className":175,"code":926,"filename":927,"language":177,"meta":178,"style":178},"const token = await sign(\"important document bytes\", key, {\n  protectedHeader: { b64: false, crit: [\"b64\"] },\n});\n\u002F\u002F Result: \"eyJhbGc...crit...b64...\".\u003Craw payload>.\u003Csignature>\n\u002F\u002F (note the payload is literally in the middle)\n","unencoded.ts",[180,929,930,950,966,970,975],{"__ignoreMap":178},[183,931,932,934,936,938,940,942,944,947],{"class":185,"line":186},[183,933,432],{"class":197},[183,935,467],{"class":435},[183,937,439],{"class":197},[183,939,442],{"class":197},[183,941,474],{"class":189},[183,943,448],{"class":193},[183,945,946],{"class":451},"\"important document bytes\"",[183,948,949],{"class":193},", key, {\n",[183,951,952,955,957,960,963],{"class":185,"line":462},[183,953,954],{"class":193},"  protectedHeader: { b64: ",[183,956,787],{"class":435},[183,958,959],{"class":193},", crit: [",[183,961,962],{"class":451},"\"b64\"",[183,964,965],{"class":193},"] },\n",[183,967,968],{"class":185,"line":556},[183,969,870],{"class":193},[183,971,972],{"class":185,"line":583},[183,973,974],{"class":458},"\u002F\u002F Result: \"eyJhbGc...crit...b64...\".\u003Craw payload>.\u003Csignature>\n",[183,976,977],{"class":185,"line":847},[183,978,979],{"class":458},"\u002F\u002F (note the payload is literally in the middle)\n",[203,981,982,983,985,986,989],{},"Always pair ",[180,984,900],{}," with ",[180,987,988],{},"crit: [\"b64\"]"," so verifiers that don't recognize the parameter reject the token instead of mis-validating it.",[991,992,993],"warning",{},[203,994,995,996,998,999,1001],{},"All signers of a multi-signature JWS must agree on ",[180,997,783],{},". See ",[905,1000,45],{"href":46},".",[212,1003,1005],{"id":1004},"payload-types","Payload types",[203,1007,1008,1011],{},[180,1009,1010],{},"sign()"," accepts three payload shapes:",[217,1013,1014,1024],{},[220,1015,1016],{},[223,1017,1018,1021],{},[226,1019,1020],{},"Shape",[226,1022,1023],{},"Behavior",[236,1025,1026,1040,1054],{},[223,1027,1028,1033],{},[241,1029,1030],{},[180,1031,1032],{},"Record\u003Cstring, unknown>",[241,1034,1035,1036,1039],{},"Serialized to JSON. ",[180,1037,1038],{},"typ: \"JWT\""," added automatically if not set.",[223,1041,1042,1047],{},[241,1043,1044],{},[180,1045,1046],{},"string",[241,1048,1049,1050,1053],{},"UTF-8 encoded as-is. No ",[180,1051,1052],{},"typ"," defaulting — you're not producing a JWT.",[223,1055,1056,1060],{},[241,1057,1058],{},[180,1059,506],{},[241,1061,1062,1063,1065],{},"Used as-is. No ",[180,1064,1052],{}," defaulting.",[203,1067,1068,1069,1072,1073,1078],{},"The type is inferred so ",[180,1070,1071],{},"verify()"," returns the same shape (see ",[905,1074,1075],{"href":42},[180,1076,1077],{},"forceUint8Array"," if you want bytes back).",[212,1080,1082],{"id":1081},"full-signature","Full signature",[173,1084,1086],{"className":175,"code":1085,"language":177,"meta":178,"style":178},"interface JWSSignOptions {\n  alg?: JWSAlgorithm;\n  protectedHeader?: StrictOmit\u003CJWSHeaderParameters, \"alg\"> & { alg?: never };\n  currentDate?: Date;\n  expiresIn?: ExpiresIn;\n  expiresAt?: Date;\n  notBeforeIn?: ExpiresIn;\n  notBeforeAt?: Date;\n}\n",[180,1087,1088,1099,1113,1152,1164,1176,1187,1198,1210],{"__ignoreMap":178},[183,1089,1090,1093,1096],{"class":185,"line":186},[183,1091,1092],{"class":197},"interface",[183,1094,1095],{"class":189}," JWSSignOptions",[183,1097,1098],{"class":193}," {\n",[183,1100,1101,1105,1108,1111],{"class":185,"line":462},[183,1102,1104],{"class":1103},"sQHwn","  alg",[183,1106,1107],{"class":197},"?:",[183,1109,1110],{"class":189}," JWSAlgorithm",[183,1112,547],{"class":193},[183,1114,1115,1118,1120,1123,1126,1128,1130,1133,1136,1139,1142,1144,1146,1149],{"class":185,"line":556},[183,1116,1117],{"class":1103},"  protectedHeader",[183,1119,1107],{"class":197},[183,1121,1122],{"class":189}," StrictOmit",[183,1124,1125],{"class":193},"\u003C",[183,1127,301],{"class":189},[183,1129,322],{"class":193},[183,1131,1132],{"class":451},"\"alg\"",[183,1134,1135],{"class":193},"> ",[183,1137,1138],{"class":197},"&",[183,1140,1141],{"class":193}," { ",[183,1143,288],{"class":1103},[183,1145,1107],{"class":197},[183,1147,1148],{"class":435}," never",[183,1150,1151],{"class":193}," };\n",[183,1153,1154,1157,1159,1162],{"class":185,"line":583},[183,1155,1156],{"class":1103},"  currentDate",[183,1158,1107],{"class":197},[183,1160,1161],{"class":189}," Date",[183,1163,547],{"class":193},[183,1165,1166,1169,1171,1174],{"class":185,"line":847},[183,1167,1168],{"class":1103},"  expiresIn",[183,1170,1107],{"class":197},[183,1172,1173],{"class":189}," ExpiresIn",[183,1175,547],{"class":193},[183,1177,1178,1181,1183,1185],{"class":185,"line":861},[183,1179,1180],{"class":1103},"  expiresAt",[183,1182,1107],{"class":197},[183,1184,1161],{"class":189},[183,1186,547],{"class":193},[183,1188,1189,1192,1194,1196],{"class":185,"line":867},[183,1190,1191],{"class":1103},"  notBeforeIn",[183,1193,1107],{"class":197},[183,1195,1173],{"class":189},[183,1197,547],{"class":193},[183,1199,1201,1204,1206,1208],{"class":185,"line":1200},8,[183,1202,1203],{"class":1103},"  notBeforeAt",[183,1205,1107],{"class":197},[183,1207,1161],{"class":189},[183,1209,547],{"class":193},[183,1211,1213],{"class":185,"line":1212},9,[183,1214,1215],{"class":193},"}\n",[203,1217,1218,1220,1221,1224,1225,1220,1228,1231,1232,1235,1236,1239],{},[180,1219,610],{}," and ",[180,1222,1223],{},"expiresAt"," are mutually exclusive; ",[180,1226,1227],{},"notBeforeIn",[180,1229,1230],{},"notBeforeAt"," are likewise mutually exclusive. ",[180,1233,1234],{},"notBeforeIn: 0"," is allowed and sets ",[180,1237,1238],{},"nbf = iat"," (an explicit temporal floor at sign time).",[212,1241,1243],{"id":1242},"see-also","See also",[498,1245,1246,1252,1261],{},[501,1247,1248,1251],{},[905,1249,1250],{"href":42},"Verifying →"," — the consumer side.",[501,1253,1254,1257,1258,1260],{},[905,1255,1256],{"href":50},"Algorithms →"," — which ",[180,1259,288],{}," to pick.",[501,1262,1263,1266],{},[905,1264,1265],{"href":46},"Multi-signature →"," — more than one signer.",[1268,1269,1270],"style",{},"html pre.shiki code .shcOC, html code.shiki .shcOC{--shiki-light:#6F42C1;--shiki-default:#B392F0;--shiki-dark:#B392F0}html pre.shiki code .slsVL, html code.shiki .slsVL{--shiki-light:#24292E;--shiki-default:#E1E4E8;--shiki-dark:#E1E4E8}html pre.shiki code .so5gQ, html code.shiki .so5gQ{--shiki-light:#D73A49;--shiki-default:#F97583;--shiki-dark:#F97583}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .suiK_, html code.shiki .suiK_{--shiki-light:#005CC5;--shiki-default:#79B8FF;--shiki-dark:#79B8FF}html pre.shiki code .sfrk1, html code.shiki .sfrk1{--shiki-light:#032F62;--shiki-default:#9ECBFF;--shiki-dark:#9ECBFF}html pre.shiki code .sCsY4, html code.shiki .sCsY4{--shiki-light:#6A737D;--shiki-default:#6A737D;--shiki-dark:#6A737D}html pre.shiki code .sQHwn, html code.shiki .sQHwn{--shiki-light:#E36209;--shiki-default:#FFAB70;--shiki-dark:#FFAB70}",{"title":178,"searchDepth":462,"depth":462,"links":1272},[1273,1274,1275,1277,1281,1283,1284,1285],{"id":214,"depth":462,"text":215},{"id":404,"depth":462,"text":405},{"id":607,"depth":462,"text":1276},"expiresIn — setting exp declaratively",{"id":766,"depth":462,"text":767,"children":1278},[1279],{"id":874,"depth":556,"text":1280},"kid fallback",{"id":897,"depth":462,"text":1282},"b64: false — RFC 7797 unencoded payload",{"id":1004,"depth":462,"text":1005},{"id":1081,"depth":462,"text":1082},{"id":1242,"depth":462,"text":1243},"md",{},{},{"title":37,"description":178},"2tvlmAi3AEQH8eQo2TfR-QxLH2k13dJb8tjeqt7Kz-4",[1292,1293],{"title":30,"path":31,"stem":32,"description":178,"icon":35,"children":-1},{"title":41,"path":42,"stem":43,"description":178,"children":-1},1776888560723]