keylab

Appearance

keylabJWT and JWKS tooling that stays portable

Create, sign, verify, and inspect tokens with PEM, JWK, and JWKS support across Node.js, Cloudflare Workers, browsers, and Bun.

Get Started
API Summary
GitHub

Cross-runtime by default

Use the same library in Node.js, Workers, browsers, and Bun without pulling Node-only crypto at module load time.

JWT and JWKS focused

Generate keys, sign tokens, verify claims, and validate against adhoc keys or remote JWKS endpoints.

Portable curve support

Keep using ES256K, Ed448, X448, and ML-DSA through keylab's portable fallback layer when the runtime does not cover them directly.

Install ​

bash
bun add keylab
bash
npm install keylab
bash
yarn add keylab

Quick example ​

ts
import {
  getKeyPair,
  signJwtWithPrivateKey,
  checkTokenValidness,
  JwtAlgorithmsEnum as Algs,
} from "keylab"

const keyPair = await getKeyPair({
  keyFormat: "jwk",
  algorithmIdentifier: Algs.ES256,
  keySize: 2048,
})

const token = await signJwtWithPrivateKey(
  { sub: "user-123", iss: "https://issuer.example" },
  Algs.ES256,
  keyPair.privateKey,
  { kid: keyPair.kid },
)

const verified = await checkTokenValidness(token, {
  adhoc: [keyPair.publicKey],
})