@breadai/auth-jwt

JWT auth for bread — verifies incoming bearer tokens via jose, either an HS256 symmetric secret or a remote JWKS (RS/ES). Verification only — no signer.

bun add @breadai/auth-jwt   # or: npm i @breadai/auth-jwt

import { authStrategy } from '@breadai/auth-jwt'

const strategy = authStrategy({
  secret: process.env.JWT_SECRET,                   // HS256, or:
  jwksUri: 'https://issuer/.well-known/jwks.json',  // RS/ES via remote JWKS
  issuer: 'urn:my:issuer',
  audience: 'urn:my:api',
})

The resolved identity carries the full claims: { subject: payload.sub, claims: payload }. Pass strategy to @breadai/server's authPlugin() to guard a running server.

Part of bread — an explicit-by-design framework for AI agents. Docs: auth · all docs.

License

MIT © Matteo Zambon