docs/jwt/encrypt/classes/EncryptJWT.md
Support from the community to continue maintaining and improving this module is welcome. If you find the module useful, please consider supporting the project by becoming a sponsor.
Builds and encrypts Compact JWE-formatted JSON Web Tokens.
This class is exported (as a named export) from the main 'jose' module entry point as well as
from its subpath export 'jose/jwt/encrypt'.
const secret = jose.base64url.decode('zH4NRP1HMALxxCFnRZABFA7GOJtzU_gIj02alfL1lvI')
const jwt = await new jose.EncryptJWT({ 'urn:example:claim': true })
.setProtectedHeader({ alg: 'dir', enc: 'A128CBC-HS256' })
.setIssuedAt()
.setIssuer('urn:example:issuer')
.setAudience('urn:example:audience')
.setExpirationTime('2h')
.encrypt(secret)
console.log(jwt)
⸠new EncryptJWT(payload?): EncryptJWT
| Parameter | Type | Description |
|---|---|---|
payload? | JWTPayload | Initial JWT Claims Set. Defaults to an empty object. |
EncryptJWT
⸠encrypt(key, options?): Promise<string>
Encrypts and returns the JWT.
| Parameter | Type | Description |
|---|---|---|
key | KeyInput | Public key or shared secret to encrypt the JWT with. See Algorithm Key Requirements. |
options? | EncryptOptions | JWE Encryption options. |
Promise<string>
⸠replicateAudienceAsHeader(): this
Replicates the "aud" (Audience) Claim in the JWE Protected Header, exposing it without decryption.
this
⸠replicateIssuerAsHeader(): this
Replicates the "iss" (Issuer) Claim in the JWE Protected Header, exposing it without decryption.
this
⸠replicateSubjectAsHeader(): this
Replicates the "sub" (Subject) Claim in the JWE Protected Header, exposing it without decryption.
this
⸠setAudience(audience): this
Set the "aud" (Audience) Claim.
| Parameter | Type | Description |
|---|---|---|
audience | string | string[] | "aud" (Audience) Claim value to set on the JWT Claims Set. |
this
⸠setContentEncryptionKey(cek): this
Sets the content encryption key. By default, a suitable random key is generated for the JWE "enc" (Encryption Algorithm). May only be called once.
| Parameter | Type | Description |
|---|---|---|
cek | Uint8Array | JWE Content Encryption Key. |
this
For testing and vector validation only; allow random generation in production.
⸠setExpirationTime(input): this
Set the "exp" (Expiration Time) Claim. Accepts a Unix timestamp in seconds, a Date, or a duration relative to now using the same formats as setNotBefore.
Format used for time span should be a number followed by a unit, such as "5 minutes" or "1 day".
Valid unit spellings are: "sec", "secs", "second", "seconds", "s", "minute", "minutes", "min", "mins", "m", "hour", "hours", "hr", "hrs", "h", "day", "days", "d", "week", "weeks", "w", "year", "years", "yr", "yrs", and "y".
A "from now" suffix can be used for readability when adding to the current Unix timestamp.
| Parameter | Type | Description |
|---|---|---|
input | string | number | Date | "exp" (Expiration Time) Claim value as a timestamp, Date, or relative duration. |
this
⸠setInitializationVector(iv): this
Sets the Initialization Vector for content encryption. By default, a suitable random IV is generated for the JWE "enc" (Encryption Algorithm). May only be called once.
| Parameter | Type | Description |
|---|---|---|
iv | Uint8Array | JWE Initialization Vector. |
this
For testing and vector validation only; allow random generation in production.
⸠setIssuedAt(input?): this
Set the "iat" (Issued At) Claim. Defaults to the current Unix timestamp in seconds. Accepts a Unix timestamp in seconds, a Date, or a duration relative to now using the same formats as setNotBefore.
Format used for time span should be a number followed by a unit, such as "5 minutes" or "1 day".
Valid unit spellings are: "sec", "secs", "second", "seconds", "s", "minute", "minutes", "min", "mins", "m", "hour", "hours", "hr", "hrs", "h", "day", "days", "d", "week", "weeks", "w", "year", "years", "yr", "yrs", and "y".
A "from now" suffix can be used for readability when adding to the current Unix timestamp.
| Parameter | Type | Description |
|---|---|---|
input? | string | number | Date | "iat" (Issued At) Claim value as a timestamp, Date, or relative duration. |
this
⸠setIssuer(issuer): this
Set the "iss" (Issuer) Claim.
| Parameter | Type | Description |
|---|---|---|
issuer | string | "Issuer" Claim value to set on the JWT Claims Set. |
this
⸠setJti(jwtId): this
Set the "jti" (JWT ID) Claim.
| Parameter | Type | Description |
|---|---|---|
jwtId | string | "jti" (JWT ID) Claim value to set on the JWT Claims Set. |
this
⸠setKeyManagementParameters(parameters): this
Sets JWE Key Management parameters, such as ECDH-ES "apu" and "apv" or PBES2 "p2c", and adds them to the appropriate JOSE Header. Use this instead of the header setters for algorithm inputs. May only be called once.
| Parameter | Type | Description |
|---|---|---|
parameters | JWEKeyManagementHeaderParameters | JWE Key Management parameters. |
this
⸠setNotBefore(input): this
Set the "nbf" (Not Before) Claim. Numbers are Unix timestamps in seconds; Dates are converted
to seconds. Strings are relative to now, using seconds, minutes, hours, days, weeks, or years
(365.25 days; no months). Prefix - or suffix ago subtracts the duration.
Format used for time span should be a number followed by a unit, such as "5 minutes" or "1 day".
Valid unit spellings are: "sec", "secs", "second", "seconds", "s", "minute", "minutes", "min", "mins", "m", "hour", "hours", "hr", "hrs", "h", "day", "days", "d", "week", "weeks", "w", "year", "years", "yr", "yrs", and "y".
A "from now" suffix can be used for readability when adding to the current Unix timestamp.
| Parameter | Type | Description |
|---|---|---|
input | string | number | Date | "nbf" (Not Before) Claim value as a timestamp, Date, or relative duration. |
this
⸠setProtectedHeader(protectedHeader): this
Sets the JWE Protected Header. May only be called once.
| Parameter | Type | Description |
|---|---|---|
protectedHeader | CompactJWEHeaderParameters | JWE Protected Header. Must contain an "alg" (JWE Algorithm) and "enc" (JWE Encryption Algorithm) properties. |
this
⸠setSubject(subject): this
Set the "sub" (Subject) Claim.
| Parameter | Type | Description |
|---|---|---|
subject | string | "sub" (Subject) Claim value to set on the JWT Claims Set. |
this