Struct Es256Signer 

pub struct Es256Signer { /* private fields */ }

Signs ES256 JWTs with a P-256 private key.

The nonce is RFC 6979 deterministic, so the same key over the same input always yields the same token — which is what lets the APNs adapter’s cache be a plain “same token until it ages out”, and lets a test assert an exact token string.

Implementations

impl Es256Signer

pub fn from_pkcs8_pem(pem: &str) -> Result<Self, KeyError>

Parses a PKCS#8 PEM P-256 private key.

Errors

KeyError::Parse if the PEM is not a PKCS#8 P-256 private key.

pub fn from_p8_pem(pem: &str) -> Result<Self, KeyError>

Apple’s name for the same thing: the .p8 downloaded from the developer portal is a PKCS#8 PEM.

Errors

KeyError::Parse if the .p8 is not a PKCS#8 P-256 private key.

pub fn from_scalar(scalar: &[u8; 32]) -> Result<Self, KeyError>

The bare 32-byte P-256 private scalar, with no PKCS#8 wrapper around it — which is how a VAPID key is usually handed over (issue #180). Every generator in that ecosystem prints the scalar base64url and calls it VAPID_PRIVATE_KEY; the caller decodes it and passes the bytes.

Errors

KeyError::Parse if the scalar is zero or not below the curve order, neither of which is a usable private key.

pub fn sign_jwt(&self, header: &Value, claims: &Value) -> String

Signs header/claims into a compact JWS.

The caller owns the claims because they differ per provider: APNs wants iss/iat, VAPID wants aud/sub/exp. alg and kid belong in header.

pub fn public_key_uncompressed(&self) -> [u8; 65]

The public key as an uncompressed SEC1 point (0x04 || x || y), the form VAPID sends as k= and a JWKS splits into x/y.

Trait Implementations

impl Debug for Es256Signer

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Never prints the key.