basil-nats 0.6.0

Generic, dependency-light builder for NATS account/user JWTs (ed25519-nkey) where signing is delegated to an external signer (e.g. a key held in a vault/HSM).
Documentation

basil-nats: build NATS JWTs (the ed25519-nkey JWS profile) without holding the signing key.

NATS credentials (nsc-style) are JWTs signed by an Ed25519 NKey. This crate produces the exact wire bytes a NATS server expects, but splits signing out: you build the signing input, hand it to whatever holds the key (an HSM, a nkeys::KeyPair, or a Vault transit engine) to produce a raw 64-byte Ed25519 signature, then [assemble] the final token. The key never has to enter this process, which is the whole point of using it from a broker.

Wire format (matches nats-io/jwt v2 / nsc):

  • header: {"typ":"JWT","alg":"ed25519-nkey"}
  • jti: base32 (no pad) of SHA-512/256 over the standard claims only (aud,exp,jti="",iat,iss,name,nbf,sub). The nats object is excluded.
  • header & claims: base64url no-pad; signing input is header.claims.
  • signature: raw 64-byte Ed25519, base64url no-pad, appended as the 3rd part.

Claim field order does not affect validity (servers parse JSON), but the jti hash is order-sensitive, so the hash struct mirrors nats-io/jwt.