barrel_mcp_jwt (barrel_mcp v3.0.1)

View Source

The little JOSE the OAuth client needs: signing a JWT with ES256, RS256 or HS256, a P-256 key as a JWK, and its RFC 7638 thumbprint. Used for private_key_jwt client assertions (RFC 7523) and DPoP proofs (RFC 9449).

Summary

Types

alg/0
key/0

Functions

b64url(Bin)
decode_pem(Pem)

The private key in a PEM, PKCS#8 (PRIVATE KEY) or the type-specific encodings.

generate_key()

A fresh P-256 key, for DPoP.

jwk(_)

The public half of a P-256 key as a JWK (RFC 7518 6.2.1).

sign(Claims, Key, Alg)

A signed JWT for Claims (binary-keyed map) with the header {"alg": Alg, "typ": "JWT"}.

sign(Header, Claims, Key, Alg)

As sign/3 with extra header members (typ, jwk, ...).

thumbprint(_)

RFC 7638: SHA-256 of the required members, lexically ordered, serialised without whitespace.

Types

alg/0

-type alg() :: binary().

key/0

-type key() :: public_key:ecdsa_private_key() | public_key:rsa_private_key() | {hmac, binary()}.

Functions

b64url(Bin)

-spec b64url(binary()) -> binary().

decode_pem(Pem)

-spec decode_pem(binary()) -> key().

The private key in a PEM, PKCS#8 (PRIVATE KEY) or the type-specific encodings.

generate_key()

-spec generate_key() -> public_key:ecdsa_private_key().

A fresh P-256 key, for DPoP.

jwk(_)

-spec jwk(public_key:ecdsa_private_key()) -> map().

The public half of a P-256 key as a JWK (RFC 7518 6.2.1).

sign(Claims, Key, Alg)

-spec sign(map(), key(), alg()) -> binary().

A signed JWT for Claims (binary-keyed map) with the header {"alg": Alg, "typ": "JWT"}.

sign(Header, Claims, Key, Alg)

-spec sign(map(), map(), key(), alg()) -> binary().

As sign/3 with extra header members (typ, jwk, ...).

thumbprint(_)

-spec thumbprint(map()) -> binary().

RFC 7638: SHA-256 of the required members, lexically ordered, serialised without whitespace.