Module jwt 

JWT bearer-token authentication (HS256 / RS256 / ES256).

JwtAuthInterceptor verifies the Authorization: Bearer <jwt> on every request against a JwtValidator: it checks the signature (using ring), then the exp/nbf times and the expected issuer and audience. Verifying keys come from a static Jwks, a shared HS256 secret, or a remote JWKS endpoint (fetched, cached, and refetched on key rotation).

Only the three JOSE algorithms the A2A ecosystem uses in practice are accepted; alg: none and any unlisted algorithm are rejected outright, so the classic algorithm-confusion downgrade (an RSA public key coerced into an HMAC key) cannot occur — HS256 is only ever checked against a secret you configured, never against a JWKS public key.

Example — validate RS256 tokens from an OIDC issuer

use a2a_protocol_server::auth::jwt::{JwtAuthInterceptor, JwtValidator};
let validator = JwtValidator::new()
    .with_issuer("https://login.example.com")
    .with_audience("my-a2a-agent");

// Fetches the issuer's JWKS via OIDC discovery; caches and auto-refreshes.
let interceptor = JwtAuthInterceptor::from_oidc_issuer(
    "https://login.example.com",
    validator,
)
.await?;

Structs

Jwks

A set of asymmetric verification keys (an RFC 7517 JWK Set).

JwtAuthInterceptor

A ServerInterceptor that authenticates requests with a signed JWT.

JwtValidator

The set of claim checks applied after a JWT’s signature verifies.