@nanolink/signing-client

TypeScript npm package for interacting with the Signing Service API that issues RS256 JWTs and publishes JWKS.

Install

npm install @nanolink/signing-client

Usage

import { SigningClient } from "@nanolink/signing-client";

const client = new SigningClient({ baseUrl: "http://localhost:8080" });

const health = await client.healthz();
const signed = await client.sign({
  sub: "device-42",
  kind: "access",
  aud: ["api.example.com"],
  ttl_seconds: 3600,
  claims: { tid: "tenant-acme", ver: 3 }
});
const jwks = await client.getJwks();
const publicKeyPem = await client.getPublicKeyPem();

Base URL

• Default: http://localhost:8080
• Override with new SigningClient({ baseUrl: "..." })

API

• healthz() -> { status: "ok" }
• sign(request) -> { token: string }
• getJwks() -> { keys: Jwk[] }
• getPublicKeyPem(kid?) -> string (SPKI PEM public key)

sign(request) payload

type TokenKind = "access" | "service" | "password_reset" | "2fa";

interface SignRequest {
  sub: string;                 // required, non-empty
  kind: TokenKind;             // required
  aud?: string[];              // optional
  ttl_seconds?: number;        // optional, positive integer
  claims?: Record<string, unknown>; // optional (reserved names rejected)
}

Reserved claim names in claims (rejected): iss, sub, aud, iat, exp, kind.

getJwks() response

interface JwksResponse {
  keys: Array<{
    kty: "RSA";
    use: "sig";
    alg: "RS256";
    kid: string;
    n: string;
    e: string;
  }>;
}

Error handling

All non-2xx responses throw SigningClientError with:

• status: HTTP status code
• message: value from service error JSON ({ "error": "..." }) when present
• body: response payload when available