🔐 JWKS CLI Tool

A robust, interactive command-line utility for managing JSON Web Key Sets (JWKS) and JSON Web Tokens (JWT). This tool allows you to generate, import, and archive cryptographic workspaces to simplify local development and debugging of identity systems.

🚀 Quick Start

You can run the tool instantly without installation using npx:

npx jwks-cli-tool

✨ Key Features

• Configurable Key Generation: Support for Asymmetric (RS256/384/512, PS256/384/512, ES256/384/512, EdDSA) and Symmetric (HS256/384/512) algorithms.
• Cryptographic Matching: Import external private keys (.pem) and automatically verify if they match a public key in your JWKS using RFC 7638 Thumbprints.
• Workspace Portability: Save your entire session (keys, JWKS, and active tokens) as a compressed .tar.gz archive to share with teammates or move between environments.
• Flexible Data Loading: Fetch JWKS directly from a remote URL (e.g., Auth0, AWS Cognito) or load from local files.
• JWT Sandbox:
  • Sign tokens with fully customizable payloads and standard claims (iss, aud, exp).
  • Verify tokens against the current in-memory JWKS.
  • Decode and inspect any JWT header/payload without needing a key.

🛠 Installation

If you prefer to install the tool globally for frequent use:

npm install -g jwks-cli-tool

📖 Usage Guide

Once launched, the interactive menu guides you through the following workflow:

1. Generate or Load: Start by generating a fresh key pair or loading an existing jwks.json.
2. Manage Workspace: View your JWKS in the console or remove specific keys to simulate key rotation or revocation.
3. Sign & Test: Build a custom JWT. The tool will prompt for your payload fields and automatically handle expiration math (e.g., entering 2h for 2 hours).
4. Export: Save your generated keys as standard .pem files or pack the entire session into a portable workspace tarball.

🛡 Security Note

This tool is intended for local development and debugging purposes only.

• Symmetric secrets (the HS family) are included in the JWKS output for local testing convenience, but they should never be published to a public JWKS endpoint in a production environment.
• Always handle the .pem and .tar.gz files generated by this tool with the same care as any other sensitive credentials.

Additional Notes

There is an experimental web app version of this tool hosted here: https://jwks.ltrii.com

📄 License

MIT