Generate a JWT in Node using inputs like jwt IO

Question

I have a header, payload, and a public/private key. I can plug these all into JWT.io and it works as expected, but I'm struggling how to use these same variables with a node library like jsonwebtoken or other similar options. They seem to take a secret and sign a payload as far as I can see, which doesn't seem to line up with my inputs. I need to dynamically generate this token request so I must have the function in Node.

Thanks for any tips.

thomaux · Accepted Answer · 2023-01-04 12:47:01Z

2

Have a look at the jsonwebtoken NPM package, which offers amongst other methods, a sign method:

var jwt = require('jsonwebtoken');

var privateKey = fs.readFileSync('private.key');
var payload = { foo: 'bar' };
var token = jwt.sign(payload, privateKey, { algorithm: 'RS256' });

As @jps has pointed out, you need the private key to sign and the public key to verify.

The header will be automatically generated and will include both properties (alg and typ) you have mentioned in your comment. You can add additional properties by passing them in the options.header parameter.

edited Jan 4, 2023 at 12:47

answered Jan 4, 2023 at 11:44

thomaux

19.8k10 gold badges83 silver badges107 bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

edencorbin Over a year ago

I'm probably missing something obvious, but where does my public key go, in JWT.io it accepts both public and private? Also, headers? I think that is in options, is that covered with the algorithm choice? My header is just { "alg": "RS256", "typ": "JWT" }

jps Over a year ago

@edencorbin The public key is only needed to verify the signature, therefore you use it with jwt.verify(). For signing, you only need the private key, as shown in the answer.

edencorbin Over a year ago

This did indeed work, I was confused why you enter the public one in JWT.io.

thomaux Over a year ago

@edencorbin you pass in the public key in JWT.io to verify that the JWT you pasted in the tool was indeed signed with the private key belonging to the public key

user9775882 · Accepted Answer · 2023-01-04 21:10:35Z

1

I'm struggling how to use these same variables with a node library

import * as jose from 'jose';

const privateKey = await jose.importPKCS8(privateKeyPEM); // private key just like on jwt.io

const jwt = await new jose.SignJWT(payload) // payload just like on jwt.io
  .setProtectedHeader(header) // header just like on jwt.io
  .sign(privateKey);

Of course there's more to be discovered if you need it.

answered Jan 4, 2023 at 21:10

user9775882

Collectives™ on Stack Overflow

Generate a JWT in Node using inputs like jwt IO

2 Answers 2

4 Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

4 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related