docs/jwt/encrypt/classes/EncryptJWT.md
Support from the community to continue maintaining and improving this module is welcome. If you find the module useful, please consider supporting the project by becoming a sponsor.
The EncryptJWT class is used to build and encrypt Compact JWE formatted JSON Web Tokens.
This class is exported (as a named export) from the main 'jose' module entry point as well as
from its subpath export 'jose/jwt/encrypt'.
const secret = jose.base64url.decode('zH4NRP1HMALxxCFnRZABFA7GOJtzU_gIj02alfL1lvI')
const jwt = await new jose.EncryptJWT({ 'urn:example:claim': true })
.setProtectedHeader({ alg: 'dir', enc: 'A128CBC-HS256' })
.setIssuedAt()
.setIssuer('urn:example:issuer')
.setAudience('urn:example:audience')
.setExpirationTime('2h')
.encrypt(secret)
console.log(jwt)
⸠new EncryptJWT(payload?): EncryptJWT
EncryptJWT constructor
| Parameter | Type | Description |
|---|---|---|
payload | JWTPayload | The JWT Claims Set object. Defaults to an empty object. |
EncryptJWT
⸠encrypt(key, options?): Promise<string>
Encrypts and returns the JWT.
| Parameter | Type | Description |
|---|---|---|
key | KeyInput | Public Key or Secret to encrypt the JWT with. See Algorithm Key Requirements. |
options? | EncryptOptions | JWE Encryption options. |
Promise<string>
⸠replicateAudienceAsHeader(): this
Replicates the "aud" (Audience) Claim as a JWE Protected Header Parameter.
this
⸠replicateIssuerAsHeader(): this
Replicates the "iss" (Issuer) Claim as a JWE Protected Header Parameter.
this
⸠replicateSubjectAsHeader(): this
Replicates the "sub" (Subject) Claim as a JWE Protected Header Parameter.
this
⸠setAudience(audience): this
Set the "aud" (Audience) Claim.
| Parameter | Type | Description |
|---|---|---|
audience | string | string[] | "aud" (Audience) Claim value to set on the JWT Claims Set. |
this
⸠setContentEncryptionKey(cek): this
Sets a content encryption key to use, by default a random suitable one is generated for the JWE "enc" (Encryption Algorithm) Header Parameter.
| Parameter | Type | Description |
|---|---|---|
cek | Uint8Array | JWE Content Encryption Key. |
this
You should not use this method. It is only really intended for test and vector validation purposes.
⸠setExpirationTime(input): this
Set the "exp" (Expiration Time) Claim. A number is used directly, a Date is converted to a
Unix timestamp, and a string is parsed as a time span relative to the current Unix timestamp.
String units may be seconds, minutes, hours, days, weeks, or years; months are unsupported and
a year is 365.25 days. A leading - or trailing "ago" subtracts the time span.
Format used for time span should be a number followed by a unit, such as "5 minutes" or "1 day".
Valid unit spellings are: "sec", "secs", "second", "seconds", "s", "minute", "minutes", "min", "mins", "m", "hour", "hours", "hr", "hrs", "h", "day", "days", "d", "week", "weeks", "w", "year", "years", "yr", "yrs", and "y".
A "from now" suffix can be used for readability when adding to the current Unix timestamp.
| Parameter | Type | Description |
|---|---|---|
input | string | number | Date | "exp" (Expiration Time) Claim value to set on the JWT Claims Set. |
this
⸠setInitializationVector(iv): this
Sets the JWE Initialization Vector to use for content encryption, by default a random suitable one is generated for the JWE "enc" (Encryption Algorithm) Header Parameter.
| Parameter | Type | Description |
|---|---|---|
iv | Uint8Array | JWE Initialization Vector. |
this
You should not use this method. It is only really intended for test and vector validation purposes.
⸠setIssuedAt(input?): this
Set the "iat" (Issued At) Claim. With no argument the current Unix timestamp is used. A
number is used directly, a Date is converted to a Unix timestamp, and a string is parsed
as a time span relative to the current Unix timestamp. String units may be seconds, minutes,
hours, days, weeks, or years; months are unsupported and a year is 365.25 days. A leading -
or trailing "ago" subtracts the time span.
Format used for time span should be a number followed by a unit, such as "5 minutes" or "1 day".
Valid unit spellings are: "sec", "secs", "second", "seconds", "s", "minute", "minutes", "min", "mins", "m", "hour", "hours", "hr", "hrs", "h", "day", "days", "d", "week", "weeks", "w", "year", "years", "yr", "yrs", and "y".
A "from now" suffix can be used for readability when adding to the current Unix timestamp.
| Parameter | Type | Description |
|---|---|---|
input? | string | number | Date | "iat" (Issued At) Claim value to set on the JWT Claims Set. |
this
⸠setIssuer(issuer): this
Set the "iss" (Issuer) Claim.
| Parameter | Type | Description |
|---|---|---|
issuer | string | "Issuer" Claim value to set on the JWT Claims Set. |
this
⸠setJti(jwtId): this
Set the "jti" (JWT ID) Claim.
| Parameter | Type | Description |
|---|---|---|
jwtId | string | "jti" (JWT ID) Claim value to set on the JWT Claims Set. |
this
⸠setKeyManagementParameters(parameters): this
Sets the JWE Key Management parameters to be used when encrypting. Use this method instead of the header setters to configure algorithm inputs such as ECDH-ES "apu" (Agreement PartyUInfo) and "apv" (Agreement PartyVInfo), or PBES2 "p2c" (PBES2 Count). The parameters are added to the appropriate JOSE Header.
| Parameter | Type | Description |
|---|---|---|
parameters | JWEKeyManagementHeaderParameters | JWE Key Management parameters. |
this
⸠setNotBefore(input): this
Set the "nbf" (Not Before) Claim. A number is used directly, a Date is converted to a Unix
timestamp, and a string is parsed as a time span relative to the current Unix timestamp.
String units may be seconds, minutes, hours, days, weeks, or years; months are unsupported and
a year is 365.25 days. A leading - or trailing "ago" subtracts the time span.
Format used for time span should be a number followed by a unit, such as "5 minutes" or "1 day".
Valid unit spellings are: "sec", "secs", "second", "seconds", "s", "minute", "minutes", "min", "mins", "m", "hour", "hours", "hr", "hrs", "h", "day", "days", "d", "week", "weeks", "w", "year", "years", "yr", "yrs", and "y".
A "from now" suffix can be used for readability when adding to the current Unix timestamp.
| Parameter | Type | Description |
|---|---|---|
input | string | number | Date | "nbf" (Not Before) Claim value to set on the JWT Claims Set. |
this
⸠setProtectedHeader(protectedHeader): this
Sets the JWE Protected Header on the EncryptJWT object.
| Parameter | Type | Description |
|---|---|---|
protectedHeader | CompactJWEHeaderParameters | JWE Protected Header. Must contain an "alg" (JWE Algorithm) and "enc" (JWE Encryption Algorithm) properties. |
this
⸠setSubject(subject): this
Set the "sub" (Subject) Claim.
| Parameter | Type | Description |
|---|---|---|
subject | string | "sub" (Subject) Claim value to set on the JWT Claims Set. |
this