Verifies LiveKit HS256 JWTs against an API key and secret.
Used by LiveKit.WebhookReceiver and available for general token inspection:
iex> {:ok, verifier} = LiveKit.TokenVerifier.new(api_key: "k", api_secret: "s")
iex> {:ok, jwt} =
...> LiveKit.AccessToken.new(api_key: "k", api_secret: "s")
...> |> LiveKit.AccessToken.with_video_grant(%LiveKit.Grants.Video{room_list: true})
...> |> LiveKit.AccessToken.to_jwt()
iex> {:ok, claims} = LiveKit.TokenVerifier.verify(verifier, jwt)
iex> claims["iss"]
"k"An optional "Bearer " prefix on the token string is stripped. Clock skew of
10 seconds is allowed by default when checking exp and nbf.
Summary
Functions
The default clock skew tolerance in seconds.
Builds a verifier from keyword credentials or a LiveKit.Client.
Same as new/1 but raises LiveKit.Error on failure.
Verifies a JWT and returns its claims map (string keys).
Types
Functions
@spec default_clock_tolerance() :: pos_integer()
The default clock skew tolerance in seconds.
Examples
iex> LiveKit.TokenVerifier.default_clock_tolerance()
10@spec new(keyword() | LiveKit.Client.t()) :: {:ok, t()} | {:error, LiveKit.Error.t()}
Builds a verifier from keyword credentials or a LiveKit.Client.
Options
:api_key(required when not passing a client):api_secret(required when not passing a client)
Examples
iex> {:ok, verifier} = LiveKit.TokenVerifier.new(api_key: "k", api_secret: "s")
iex> verifier.api_key
"k"
iex> {:error, error} = LiveKit.TokenVerifier.new(api_key: "k")
iex> error.type
:validation@spec new!(keyword() | LiveKit.Client.t()) :: t()
Same as new/1 but raises LiveKit.Error on failure.
@spec verify(t(), String.t(), keyword()) :: {:ok, map()} | {:error, LiveKit.Error.t()}
Verifies a JWT and returns its claims map (string keys).
Options
:clock_tolerance- seconds of skew allowed forexp/nbf(default10)
Examples
iex> verifier = LiveKit.TokenVerifier.new!(api_key: "k", api_secret: "s")
iex> {:error, error} = LiveKit.TokenVerifier.verify(verifier, "not-a-jwt")
iex> error.type
:authentication