@rockhopper-co/identity-verifier

Verifies access tokens issued by the Rockhopper identity service. This package is the relying-party half only: it checks a signature against the issuer's published JWKS document and returns a parsed, validated payload. It does not issue tokens and holds no key material.

npm install @rockhopper-co/identity-verifier

import { createVerifier } from '@rockhopper-co/identity-verifier/verifier';

const verifier = createVerifier({
  issuer: 'https://identity.rockhopper.co',
  audience: 'https://mcp.rockhopper.co',
});

const result = await verifier.verify(token);
if (result.ok) {
  console.log(result.payload.sub, result.payload.scope);
} else {
  console.warn(result.reason); // expired | wrong_audience | unknown_key | unsupported_algorithm | ...
}

./verifier is the only published subpath. Importing the package root fails with ERR_PACKAGE_PATH_NOT_EXPORTED by design.

• EdDSA/Ed25519 supported, alongside the RSA and ECDSA families.
• Distinct failure reasons. A rejection says which check failed rather than collapsing to a single boolean, so a caller can tell an expired token from a wrong audience.
• No ambient network. Pass fetchImpl to control how the JWKS is retrieved; pass now to control the clock.

Requires Node 20 or later. Published from Rockhopper-Co/identity with npm provenance.