JWT Claim Guard

Create a tiny helper for issuing and validating compact JWT strings backed by a shared secret.

Capabilities

Issue signed tokens

• Produces a compact token string containing sub, iss, aud, iat, and exp claims using the provided inputs, with iat set to the current UTC time and exp set to iat + expires_in_seconds. @test
• When not_before_seconds is omitted the token is immediately valid; when provided it sets nbf to iat + not_before_seconds. @test

Validate tokens and claims

• A token produced by issue_token verifies successfully with the correct secret, issuer, and audience, returning a mapping of claims with numeric timestamps. @test
• Validation fails for a token whose aud does not match the expected audience. @test
• Validation fails for an expired token even when a small positive leeway is provided. @test

Implementation

@generates

API

def issue_token(
    subject: str,
    secret: str,
    issuer: str,
    audience: str,
    expires_in_seconds: int,
    not_before_seconds: int | None = None,
) -> str:
    """Return a signed JWT string containing subject and standard claims."""


def validate_token(
    token: str,
    secret: str,
    issuer: str,
    audience: str,
    leeway_seconds: int = 0,
) -> dict:
    """Verify signature plus issuer, audience, and temporal claims; return claims on success and raise on failure."""

Dependencies { .dependencies }

python-jose { .dependency }

Provides JWT encoding, decoding, and claim validation support.