moq-auth

The authorization contract for Media over QUIC: the request a relay sends per session, the grant an auth server answers with, the lease a session holds, the HTTP client that drives it, and the JWT a client presents in its query.

For the contract, the relay flags, and worked examples, see Authentication Documentation.

Grants and claims name paths with patterns: foo is one broadcast, foo/** is a subtree, ** is everything.

Quick Usage (symmetric keys)

# generate secret key
moq auth generate --out key.jwk
# sign a new JWT
moq auth sign --key key.jwk --root demo --publish 'bbb/**' > token.jwt
# verify the JWT
moq auth verify --key key.jwk < token.jwt

Quick Usage (asymmetric keys)

# generate private and public keys
moq auth generate --algorithm RS256 --out private.jwk --public public.jwk
# sign a new JWT (using private key)
moq auth sign --key private.jwk --root demo --publish 'bbb/**' > token.jwt
# verify the JWT (using public key)
moq auth verify --key public.jwk < token.jwt