Module token 

Signed request and response tokens (okp1, ADR 0014).

okp1.<base64url(claims JSON)>.<base64url(Ed25519 signature of "okp1." + claims part)>. The body claim binds the token to one request or response body.

Structs

Claims

What a token says.

Replays

Token ids seen until they expire, to refuse replays.

Constants

MAX_LIFETIME_SECS

The longest a token may live.

SKEW_SECS

Clock difference tolerated between bots.

Functions

body_hash

Hex SHA-256 of body.

peek

The claims of a token, before its signature is checked: they name the signer to look up.

sign

Signs claims.

verify

Checks a token’s signature by signer, its times and its body; returns its claims. Replays are checked separately (Replays), after the signer is known to be a member.