Enum VerifyError 

pub enum VerifyError {
    Keys(String),
    Malformed(String),
    MissingKid,
    UnknownKid(String),
    Paseto(String),
    Claim(String),
    UnsupportedAlgorithm {
        kid: String,
        algorithm: String,
    },
}

Failure modes for key-set loading and token verification.

Every fallible entry point returns this type, and every variant is a handled outcome — the crate never panics on bad input, so a malformed key set and a forged token are both ordinary Err values.

Variants

Keys(String)

The key-set document was missing or structurally invalid (no keys array, a key missing kid / x, or an x that is not a 32-byte base64url Ed25519 public key). Raised at load time, not per token.

Malformed(String)

The token was not a structurally valid v4.public token, or its footer could not be decoded as { "kid": ... }. Distinct from a signature failure (Paseto).

MissingKid

The token footer carried no kid, so no key could be selected. All auth-service tokens stamp a footer kid, so this indicates a hand-built or non-conforming token.

UnknownKid(String)

No verification key matched the token’s footer kid (stale cache, wrong issuer, or forgery). The wrapped String is the unmatched kid; on a legitimate stale cache a caller may refetch and retry.

Paseto(String)

PASETO parsing or Ed25519 signature verification failed. Carries the stringified underlying rusty_paseto error.

Claim(String)

The signature was valid but a registered claim did not satisfy the policy: wrong iss, wrong aud, expired exp, or unmet nbf.

UnsupportedAlgorithm

The token’s kid selected a key whose algorithm this build does not implement.

Distinct from UnknownKid on purpose. Both reject the token, but they mean different things to whoever is on call: UnknownKid says “I hold no key for this signer” and invites a key-set refetch; this says “I hold the key and cannot use it”, which a refetch will never fix. It is the expected error during a partial algorithm rollout — the issuer has moved ahead of this verifier, and this binary needs upgrading.

Fields

kid: String

The kid that selected the key.

algorithm: String

The algorithm label as advertised in the key set.

Trait Implementations

impl Debug for VerifyError

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Display for VerifyError

fn fmt(&self, __formatter: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Error for VerifyError

fn source(&self) -> Option<&(dyn Error + 'static)>

Returns the lower-level source of this error, if any.

fn description(&self) -> &str

👎Deprecated since 1.42.0:

use the Display impl or to_string()

fn cause(&self) -> Option<&dyn Error>

👎Deprecated since 1.33.0:

replaced by Error::source, which can support downcasting

fn provide<'a>(&'a self, request: &mut Request<'a>)

🔬This is a nightly-only experimental API. (error_generic_member_access)

Provides type-based access to context intended for error reports.