Struct Key 

pub struct Key { /* private fields */ }

A validated key, ready to sign and verify tokens.

The fields are fixed at construction: derived crypto material is cached on first use, so a key that could be mutated would sign with stale material. Build one from a Jwk, from Key::generate, or by parsing with Key::from_str, then use the builders to derive a new key rather than editing an existing one.

Implementations

impl Key

pub fn export(&self) -> Jwk

The serializable Jwk behind this key, cloned so editing it can’t reach the original.

The inverse of Jwk::import. Use it to derive a variant: export, edit, import again. Reading a single field needs no clone, since a Key derefs to its Jwk.

pub fn from_str(s: &str) -> Result<Self>

Parse a key from a string, auto-detecting JSON or base64url encoding.

pub fn from_file<P: AsRef<StdPath>>(path: P) -> Result<Self>

Load a key from a file, auto-detecting JSON or base64url encoding.

pub fn to_str(&self) -> Result<String>

Encode the key as base64url-encoded JSON.

pub fn to_file<P: AsRef<StdPath>>(&self, path: P) -> Result<()>

Write the key to a file as base64url-encoded JSON.

pub fn to_public(&self) -> Result<Self>

Derive a verify-only copy of this key, dropping the private material.

Fails for symmetric (oct) keys, which have no public half, and for a key that cannot verify in the first place.

pub fn verify(&self, token: &str) -> Result<Claims>

Verify a token’s signature with this key and return its claims.

Rejects an expired token (the exp claim) and one that grants nothing. Scoping the claims to a connection path is a separate step; see Claims::authorize.

pub fn sign(&self, payload: &Claims) -> Result<String>

Sign the claims with this key, returning the encoded token.

pub fn generate(algorithm: Algorithm, id: Option<KeyId>) -> Result<Self>

Generate a key pair for the given algorithm, returning the private and public keys.

pub fn with_scope(self, scope: Scope) -> Result<Self>

Derive a key with an authorization scope attached, capping what its tokens may grant.

The scope is validated here, and it is the only way to set one, so a key can never carry a scope that permits nothing.

pub fn with_operations( self, operations: impl IntoIterator<Item = KeyOperation>, ) -> Self

Derive a key restricted to the given operations.

Trait Implementations

impl Clone for Key

fn clone(&self) -> Key

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Key

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Deref for Key

Read-only access to the underlying Jwk fields (key.algorithm, key.kid, …).

Deliberately no DerefMut: handing out &mut Jwk would let a caller change the algorithm or key material behind the cached crypto material, which is the bug this split exists to prevent.

type Target = Jwk

The resulting type after dereferencing.

fn deref(&self) -> &Self::Target

Dereferences the value.

impl<'de> Deserialize<'de> for Key

fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>

where D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl From<&Key> for Jwk

fn from(key: &Key) -> Self

Converts to this type from the input type.

impl Serialize for Key

fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>

where S: Serializer,

Serialize this value into the given Serde serializer.

impl TryFrom<Jwk> for Key

type Error = Error

The type returned in the event of a conversion error.

fn try_from(jwk: Jwk) -> Result<Self>

Performs the conversion.