jwt-cpp

A C++20 implementation of NATS JWT library for Ed25519-based authentication tokens.

Features

• Three-tier hierarchy: Operator → Account → User claims
• Ed25519 signatures: Secure cryptography via nkeys-cpp
• JWT validation: Time-based, chain, and hierarchy validation
• NATS credentials: Generate standard .creds files
• CLI tool: jwt++ command-line utility
• Modern C++20: Type-safe API with RAII, exceptions, and smart pointers

Quick Start

Build

cmake -S . -B build -DCMAKE_BUILD_TYPE=Release
cmake --build build
ctest --test-dir build --output-on-failure

Dependencies (nkeys-cpp, nlohmann/json, GoogleTest) are auto-fetched via CMake.

Library Usage

#include <jwt/jwt.hpp>
#include <nkeys/nkeys.hpp>

// Create operator JWT (self-signed)
auto operator_kp = nkeys::CreateOperator();
jwt::OperatorClaims op_claims(operator_kp->publicString());
op_claims.setName("My Operator");
std::string op_jwt = op_claims.encode(operator_kp->seedString());

// Create account JWT (signed by operator)
auto account_kp = nkeys::CreateAccount();
jwt::AccountClaims acc_claims(account_kp->publicString());
acc_claims.setIssuer(operator_kp->publicString());
std::string acc_jwt = acc_claims.encode(operator_kp->seedString());

// Create user JWT (signed by account)
auto user_kp = nkeys::CreateUser();
jwt::UserClaims user_claims(user_kp->publicString());
user_claims.setIssuer(account_kp->publicString());
std::string user_jwt = user_claims.encode(account_kp->seedString());

// Verify signatures
bool valid = jwt::verify(user_jwt);

// Decode and inspect
auto decoded = jwt::decodeUserClaims(user_jwt);
std::cout << decoded->name().value_or("") << "\n";

// Validate complete chain
std::vector<std::string> chain = {op_jwt, acc_jwt, user_jwt};
auto result = jwt::validateChain(chain, jwt::ValidationOptions::strict());

// Generate NATS credentials file
std::string creds = jwt::formatUserConfig(user_jwt, user_kp->seedString());

CLI Tool

# Encode operator JWT
jwt++ --encode --type operator --inkey operator.seed --name "My Op"

# Encode account JWT (signed by operator)
jwt++ --encode --type account --inkey account.seed \
  --sign-key operator.seed --issuer <operator_pub>

# Encode user JWT (signed by account)
jwt++ --encode --type user --inkey user.seed \
  --sign-key account.seed --issuer <account_pub>

# Decode JWT
jwt++ --decode token.jwt

# Verify signature
jwt++ --verify token.jwt

# Generate credentials file
jwt++ --generate-creds --inkey user.seed user.jwt

Requirements

• Compiler: C++20 (GCC 10+, Clang 12+, MSVC 19.29+)
• CMake: 3.20+
• Dependencies: Auto-fetched (nkeys-cpp, nlohmann/json, GoogleTest)

License

TBD - Compatible with NATS and nkeys-cpp licensing.