Struct TokenVerifier 

pub struct TokenVerifier { /* private fields */ }

Token verifier for validating session tokens using Ed25519 (EdDSA)

Implementations

impl TokenVerifier

pub fn new( verifying_key: VerifyingKey, issuer: impl Into<String>, audience: impl Into<String>, ) -> TokenVerifier

Create a new token verifier with an Ed25519 verifying key

Uses EdDSA (Ed25519) for asymmetric signature verification. This is the recommended algorithm for production use.

pub fn with_audiences<I, S>( verifying_key: VerifyingKey, issuer: impl Into<String>, audiences: I, ) -> Result<TokenVerifier, AudienceSetError>

where I: IntoIterator<Item = S>, S: Into<String>,

Create a verifier that accepts any audience in audiences.

The matched audience reaches callers as crate::claims::AuthContext::audience, so a verifier serving several audiences can tell which one a token was minted for. Returns an error rather than defaulting to something permissive when the set is empty or blank.

pub fn with_origin_validation(self) -> TokenVerifier

Require origin validation

pub fn with_client_ip_validation(self) -> TokenVerifier

Require client IP validation

pub fn verify( &self, token: &str, expected_origin: Option<&str>, expected_client_ip: Option<&str>, ) -> Result<AuthContext, VerifyError>

Verify a token and return the auth context

Arguments

• token - The JWT token to verify
• expected_origin - Optional expected origin for origin validation
• expected_client_ip - Optional expected client IP for IP binding validation

pub fn issuer(&self) -> &str

Get the expected issuer

pub fn audiences(&self) -> &AudienceSet

The accepted audiences.

pub fn audience(&self) -> &str

👎Deprecated since 0.5.0:

use audiences(); a verifier may accept more than one audience

The sole accepted audience.

Retained for source compatibility: every verifier built through Self::new has exactly one audience, so this keeps returning what it always did. A verifier built with Self::with_audiences has no single audience — this then returns the first in sorted order, which is why it is deprecated in favour of Self::audiences. That path is unreachable for code written before multi-audience verifiers existed.