Go JOSE

https://pkg.go.dev/github.com/go-jose/go-jose/v4
Admin
Go JOSE is a Go language implementation of the Javascript Object Signing and Encryption standards,...
Tokens:36,795
Snippets:310
Trust Score:10
Update:2 weeks ago
Show doc for...
Tokens:
Raw
### Install jose-util with go install

Source: https://pkg.go.dev/github.com/go-jose/go-jose/v4/jose-util

Installs the jose-util command line utility using the go install command.

```bash
$ go install github.com/go-jose/go-jose/v4/jose-util@latest

```

--------------------------------

### Struct field tag examples for JSON marshaling

Source: https://pkg.go.dev/github.com/go-jose/go-jose/v4/json

Examples of struct field tags for JSON marshaling. The "-" tag ignores the field, "myName" renames the key, and "omitempty" omits the field when empty. The leading comma in ",omitempty" uses the default field name.

```go
// Field is ignored by this package.
Field int `json:"-"`

// Field appears in JSON as key "myName".
Field int `json:"myName"`

// Field appears in JSON as key "myName" and
// the field is omitted from the object if its value is empty,
// as defined above.
Field int `json:"myName,omitempty"`

// Field appears in JSON as key "Field" (the default), but
// the field is skipped if empty.
// Note the leading comma.
Field int `json:",omitempty"`
```

--------------------------------

### Struct field tag with string option

Source: https://pkg.go.dev/github.com/go-jose/go-jose/v4/json

Example of the "string" option in a struct field tag. It stores the field as a JSON string, applying only to string, floating point, integer, or boolean types. This is sometimes used when communicating with JavaScript programs.

```go
Int64String int64 `json:",string"`
```

--------------------------------

### Encrypter.Options

Source: https://pkg.go.dev/github.com/go-jose/go-jose/v4

Returns the options used by the encrypter.

```APIDOC
## Encrypter.Options

### Description
Returns the options used by the encrypter.

### Signature
Options() EncrypterOptions

### Returns
- **EncrypterOptions** - The options used by the encrypter.

```

--------------------------------

### Import go-jose v4 package

Source: https://pkg.go.dev/github.com/go-jose/go-jose/v4

Import the go-jose v4 package to use its JOSE standards implementation.

```go
import "github.com/go-jose/go-jose/v4"

```

--------------------------------

### Signer.Options

Source: https://pkg.go.dev/github.com/go-jose/go-jose/v4

Returns the signer options.

```APIDOC
## Signer.Options

### Description
Returns the signer options.

### Signature
```go
Options() SignerOptions
```

### Returns
- **SignerOptions** - The signer options.
```

--------------------------------

### Key Loading and Generation Functions

Source: https://pkg.go.dev/github.com/go-jose/go-jose/v4/jose-util/generator

Functions for loading and generating cryptographic keys, and a reader for base64 data.

```APIDOC
## LoadJSONWebKey

### Description
Loads a JSON Web Key (JWK) from JSON-encoded data and returns it as a *jose.JSONWebKey. The pub parameter indicates whether to load the public or private key.

### Function Signature
```go
func LoadJSONWebKey(json []byte, pub bool) (*jose.JSONWebKey, error)
```

### Parameters
- **json** ([]byte) - Required - The JSON-encoded JWK data.
- **pub** (bool) - Required - If true, loads the public key; if false, loads the private key.

### Returns
- **key** (*jose.JSONWebKey) - The loaded JSON Web Key.
- **error** (error) - An error if loading fails.
```

```APIDOC
## LoadPrivateKey

### Description
Loads a private key from PEM, DER, or JWK-encoded data.

### Function Signature
```go
func LoadPrivateKey(data []byte) (interface{}, error)
```

### Parameters
- **data** ([]byte) - Required - The PEM, DER, or JWK-encoded private key data.

### Returns
- **key** (interface{}) - The loaded private key.
- **error** (error) - An error if loading fails.
```

```APIDOC
## LoadPublicKey

### Description
Loads a public key from PEM, DER, or JWK-encoded data.

### Function Signature
```go
func LoadPublicKey(data []byte) (interface{}, error)
```

### Parameters
- **data** ([]byte) - Required - The PEM, DER, or JWK-encoded public key data.

### Returns
- **key** (interface{}) - The loaded public key.
- **error** (error) - An error if loading fails.
```

```APIDOC
## NewEncryptionKey

### Description
Generates a keypair for the corresponding KeyAlgorithm.

### Function Signature
```go
func NewEncryptionKey(alg jose.KeyAlgorithm, bits int) (crypto.PublicKey, crypto.PrivateKey, error)
```

### Parameters
- **alg** (jose.KeyAlgorithm) - Required - The key algorithm for which to generate the keypair.
- **bits** (int) - Required - The key size in bits.

### Returns
- **publicKey** (crypto.PublicKey) - The generated public key.
- **privateKey** (crypto.PrivateKey) - The generated private key.
- **error** (error) - An error if generation fails.
```

```APIDOC
## NewSigningKey

### Description
Generates a keypair for the corresponding SignatureAlgorithm.

### Function Signature
```go
func NewSigningKey(alg jose.SignatureAlgorithm, bits int) (crypto.PublicKey, crypto.PrivateKey, error)
```

### Parameters
- **alg** (jose.SignatureAlgorithm) - Required - The signature algorithm for which to generate the keypair.
- **bits** (int) - Required - The key size in bits.

### Returns
- **publicKey** (crypto.PublicKey) - The generated public key.
- **privateKey** (crypto.PrivateKey) - The generated private key.
- **error** (error) - An error if generation fails.
```

```APIDOC
## Base64Reader.Read

### Description
Reads from the underlying input stream, converting standard or url-safe base64 data to raw (unpadded) standard encoding.

### Function Signature
```go
func (r Base64Reader) Read(p []byte) (n int, err error)
```

### Parameters
- **p** ([]byte) - Required - The buffer to read data into.

### Returns
- **n** (int) - The number of bytes read.
- **err** (error) - An error if reading fails.
```

--------------------------------

### Signed

Source: https://pkg.go.dev/github.com/go-jose/go-jose/v4/jwt

Constructor for creating a signed JWT builder.

```APIDOC
## [FUNCTION] Signed

### Description
Creates a Builder that will produce a signed JWT using the provided signer.

### Signature
func Signed(sig jose.Signer) Builder

### Parameters
- **sig** (jose.Signer) - The signer used to sign the token.

### Returns
- **Builder** - A Builder for constructing the signed token.
```

--------------------------------

### NewCBCHMAC

Source: https://pkg.go.dev/github.com/go-jose/go-jose/v4/cipher

Instantiates a new AEAD based on CBC+HMAC.

```APIDOC
## NewCBCHMAC

### Description
Instantiates a new AEAD based on CBC+HMAC.

### Function Signature
```go
func NewCBCHMAC(key []byte, newBlockCipher func([]byte) (cipher.Block, error)) (cipher.AEAD, error)
```

### Parameters
- **key** ([]byte) - Required - The key for the AEAD.
- **newBlockCipher** (func([]byte) (cipher.Block, error)) - Required - A function that creates a new block cipher from a key.

### Returns
- **cipher.AEAD** - The new AEAD instance.
- **error** - An error if instantiation fails.
```

--------------------------------

### func (*EncrypterOptions) WithType

Source: https://pkg.go.dev/github.com/go-jose/go-jose/v4

Adds a type ("typ") header and returns the updated EncrypterOptions.

```APIDOC
## func (*EncrypterOptions) WithType

### Description
Adds a type ("typ") header and returns the updated EncrypterOptions.

### Signature
func (eo *EncrypterOptions) WithType(typ ContentType) *EncrypterOptions

### Parameters
- **typ** (ContentType) - Required - The type to set in the "typ" header.

### Returns
- **\*EncrypterOptions** - The updated EncrypterOptions.
```

--------------------------------

### WithTime

Source: https://pkg.go.dev/github.com/go-jose/go-jose/v4/jwt

Copies expectations with new time.

```APIDOC
## WithTime

### Description
Copies expectations with new time.

### Method Signature
```go
func (e Expected) WithTime(t time.Time) Expected
```

### Parameters
- **t** (time.Time) - The new time to set.

### Returns
- **Expected** - A copy of the expectations with the new time.
```

--------------------------------

### EncrypterOptions Methods

Source: https://pkg.go.dev/github.com/go-jose/go-jose/v4

Methods to configure EncrypterOptions for JWE encryption.

```APIDOC
## [METHOD] WithContentType

### Description
Sets the content type option for the EncrypterOptions.

### Function Signature
func (eo *EncrypterOptions) WithContentType(contentType ContentType) *EncrypterOptions

### Parameters
- **contentType** (ContentType) - Required - The content type to set.

### Returns
- **EncrypterOptions** - The updated options.
```

```APIDOC
## [METHOD] WithHeader

### Description
Sets a custom header key-value pair for the EncrypterOptions.

### Function Signature
func (eo *EncrypterOptions) WithHeader(k HeaderKey, v interface{}) *EncrypterOptions

### Parameters
- **k** (HeaderKey) - Required - The header key.
- **v** (interface{}) - Required - The header value.

### Returns
- **EncrypterOptions** - The updated options.
```

```APIDOC
## [METHOD] WithType

### Description
Sets the type option for the EncrypterOptions.

### Function Signature
func (eo *EncrypterOptions) WithType(typ ContentType) *EncrypterOptions

### Parameters
- **typ** (ContentType) - Required - The type to set.

### Returns
- **EncrypterOptions** - The updated options.
```

--------------------------------

### Compression algorithm constants (CompressionAlgorithm)

Source: https://pkg.go.dev/github.com/go-jose/go-jose/v4

Defines the CompressionAlgorithm constants for JWE compression, with NONE for no compression and DEFLATE for RFC 1951 DEFLATE. Use these values when specifying the 'zip' header parameter.

```go
const (
	NONE    = CompressionAlgorithm("")    // No compression
	DEFLATE = CompressionAlgorithm("DEF") // DEFLATE (RFC 1951)
)
```

--------------------------------

### func Signed

Source: https://pkg.go.dev/github.com/go-jose/go-jose/v4/jwt

Creates builder for signed tokens.

```APIDOC
## func Signed

### Description
Creates builder for signed tokens.

### Signature
```go
func Signed(sig jose.Signer) Builder
```

### Parameters
- **sig** (jose.Signer) - The signer to use for signing.

### Returns
- **Builder** - A Builder for signed tokens.

### Example
```go
// Output:
// eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOlsibGVlbGEiLCJmcnkiXSwiaXNzIjoiaXNzdWVyIiwibmJmIjoxNDUxNjA2NDAwLCJzdWIiOiJzdWJqZWN0In0.qEmW0Ehle1yO9XE7xZooC3AUVDF2NnJFDSgn4_6QzUo
```

### Example (MultipleClaims)
```go
// Output:
// eyJhbGciOiJIUzI1NiJ9.eyJTY29wZXMiOlsiZm9vIiwiYmFyIl0sImlzcyI6Imlzc3VlciIsInN1YiI6InN1YmplY3QifQ.9VjIUvZ8VPFg1mMPq0kTbN7CpVOfn-WChY9RAVu-I6o
```

### Example (PrivateClaims)
```go
// Output:
// eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOlsibGVlbGEiLCJmcnkiXSwiY3VzdG9tIjoiY3VzdG9tIGNsYWltIHZhbHVlIiwiaXNzIjoiaXNzdWVyIiwibmJmIjoxNDUxNjA2NDAwLCJzdWIiOiJzdWJqZWN0In0.m6GDh-23MdwYKmzGHuWLMUcx874cGbyMG7nv-5J1ifk
```
```

--------------------------------

### NewConcatKDF

Source: https://pkg.go.dev/github.com/go-jose/go-jose/v4/cipher

Builds a KDF reader based on the given inputs.

```APIDOC
## NewConcatKDF

### Description
Builds a KDF reader based on the given inputs.

### Function Signature
```go
func NewConcatKDF(hash crypto.Hash, z, algID, ptyUInfo, ptyVInfo, supPubInfo, supPrivInfo []byte) io.Reader
```

### Parameters
- **hash** (crypto.Hash) - Required - The hash function to use.
- **z** ([]byte) - Required - The shared secret.
- **algID** ([]byte) - Required - The algorithm identifier.
- **ptyUInfo** ([]byte) - Required - The party U info.
- **ptyVInfo** ([]byte) - Required - The party V info.
- **supPubInfo** ([]byte) - Required - The supplemental public info.
- **supPrivInfo** ([]byte) - Required - The supplemental private info.

### Returns
- **io.Reader** - A reader that produces the derived key material.
```

--------------------------------

### NewEncrypter

Source: https://pkg.go.dev/github.com/go-jose/go-jose/v4

Creates an appropriate encrypter based on the key type.

```APIDOC
## NewEncrypter

### Description
Creates an appropriate encrypter based on the key type.

### Signature
func NewEncrypter(enc ContentEncryption, rcpt Recipient, opts *EncrypterOptions) (Encrypter, error)

### Parameters
- **enc** (ContentEncryption) - Required - The content encryption algorithm.
- **rcpt** (Recipient) - Required - The recipient information.
- **opts** (*EncrypterOptions) - Optional - Options for the encrypter.

### Returns
- **Encrypter** - An encrypter that produces an encrypted JWE object.
- **error** - An error if the encrypter could not be created.

```

--------------------------------

### Generate key pair for signing or encryption

Source: https://pkg.go.dev/github.com/go-jose/go-jose/v4/jose-util

Generates a key pair for signing or encryption. The --use flag specifies the intended use (sig or enc), and --alg specifies the algorithm. Generated keys are written to the current directory.

```bash
# Generate keys for signing (for RSA-PSS)
jose-util generate-key --use sig --alg RS256

# Generate keys for signing (for EdDSA)
jose-util generate-key --use sig --alg EdDSA

# Generate keys for encryption (for RSA-OAEP)
jose-util generate-key --use enc --alg RSA-OAEP

# Generate keys for encryption (for ECDH-ES)
jose-util generate-key --use enc --alg ECDH-ES+A128KW

```

--------------------------------

### MarshalIndent function signature

Source: https://pkg.go.dev/github.com/go-jose/go-jose/v4/json

MarshalIndent is like Marshal but applies Indent to format the output. It takes a prefix and indent string for formatting.

```go
func MarshalIndent(v interface{}, prefix, indent string) ([]byte, error)
```

--------------------------------

### Key management algorithm constants (KeyAlgorithm)

Source: https://pkg.go.dev/github.com/go-jose/go-jose/v4

Defines the KeyAlgorithm constants for JWE key management algorithms, including RSA, AES key wrap, ECDH-ES, and PBES2 variants. Use these values when specifying the 'alg' header parameter for encryption.

```go
const (
	ED25519            = KeyAlgorithm("ED25519")
	RSA1_5             = KeyAlgorithm("RSA1_5")             // RSA-PKCS1v1.5
	RSA_OAEP           = KeyAlgorithm("RSA-OAEP")           // RSA-OAEP-SHA1
	RSA_OAEP_256       = KeyAlgorithm("RSA-OAEP-256")       // RSA-OAEP-SHA256
	A128KW             = KeyAlgorithm("A128KW")             // AES key wrap (128)
	A192KW             = KeyAlgorithm("A192KW")             // AES key wrap (192)
	A256KW             = KeyAlgorithm("A256KW")             // AES key wrap (256)
	DIRECT             = KeyAlgorithm("dir")                // Direct encryption
	ECDH_ES            = KeyAlgorithm("ECDH-ES")            // ECDH-ES
	ECDH_ES_A128KW     = KeyAlgorithm("ECDH-ES+A128KW")     // ECDH-ES + AES key wrap (128)
	ECDH_ES_A192KW     = KeyAlgorithm("ECDH-ES+A192KW")     // ECDH-ES + AES key wrap (192)
	ECDH_ES_A256KW     = KeyAlgorithm("ECDH-ES+A256KW")     // ECDH-ES + AES key wrap (256)
	A128GCMKW          = KeyAlgorithm("A128GCMKW")          // AES-GCM key wrap (128)
	A192GCMKW          = KeyAlgorithm("A192GCMKW")          // AES-GCM key wrap (192)
	A256GCMKW          = KeyAlgorithm("A256GCMKW")          // AES-GCM key wrap (256)
	PBES2_HS256_A128KW = KeyAlgorithm("PBES2-HS256+A128KW") // PBES2 + HMAC-SHA256 + AES key wrap (128)
	PBES2_HS384_A192KW = KeyAlgorithm("PBES2-HS384+A192KW") // PBES2 + HMAC-SHA384 + AES key wrap (192)
	PBES2_HS512_A256KW = KeyAlgorithm("PBES2-HS512+A256KW") // PBES2 + HMAC-SHA512 + AES key wrap (256)
)
```

--------------------------------

### NewSigner

Source: https://pkg.go.dev/github.com/go-jose/go-jose/v4

Creates an appropriate signer based on the key type.

```APIDOC
## NewSigner

### Description
Creates an appropriate signer based on the key type.

### Signature
```go
func NewSigner(sig SigningKey, opts *SignerOptions) (Signer, error)
```

### Parameters
- **sig** (SigningKey) - Required - The signing key.
- **opts** (*SignerOptions) - Optional - Options for the signer.

### Returns
- **Signer** - A signer that can produce a signed JWS object.
- **error** - An error if the signer could not be created.
```

--------------------------------

### JSON Encoding Functions

Source: https://pkg.go.dev/github.com/go-jose/go-jose/v4/json

Documentation for the Marshal and MarshalIndent functions from the go-jose JSON encoding package.

```APIDOC
## func Marshal

### Description
Marshal returns the JSON encoding of v. It traverses the value v recursively, using the Marshaler interface or encoding.TextMarshaler if implemented, and applies type-dependent default encodings for other types.

### Signature
```go
func Marshal(v interface{}) ([]byte, error)
```

### Parameters
- **v** (interface{}) - Required - The value to be encoded to JSON.

### Return Values
- **[]byte** - The JSON encoding of v.
- **error** - An error if encoding fails, such as an UnsupportedTypeError for channel, complex, or function values.
```

```APIDOC
## func MarshalIndent

### Description
MarshalIndent is like Marshal but applies Indent to format the output. It returns the JSON encoding of v with the specified prefix and indent strings.

### Signature
```go
func MarshalIndent(v interface{}, prefix, indent string) ([]byte, error)
```

### Parameters
- **v** (interface{}) - Required - The value to be encoded to JSON.
- **prefix** (string) - Required - The prefix string to prepend to each line.
- **indent** (string) - Required - The string to use for indentation.

### Return Values
- **[]byte** - The JSON encoding of v with indentation.
- **error** - An error if encoding fails.
```

--------------------------------

### func (*EncrypterOptions) WithContentType

Source: https://pkg.go.dev/github.com/go-jose/go-jose/v4

Adds a content type ("cty") header to the EncrypterOptions and returns the updated options.

```APIDOC
## func (*EncrypterOptions) WithContentType

### Description
Adds a content type ("cty") header to the EncrypterOptions and returns the updated options.

### Signature
func (eo *EncrypterOptions) WithContentType(contentType ContentType) *EncrypterOptions

### Parameters
- **contentType** (ContentType) - Required - The content type to set in the "cty" header.

### Returns
- **\*EncrypterOptions** - The updated EncrypterOptions.
```

--------------------------------

### Signature algorithm constants (SignatureAlgorithm)

Source: https://pkg.go.dev/github.com/go-jose/go-jose/v4

Defines the SignatureAlgorithm constants for JWS signing algorithms, covering HMAC, RSA, ECDSA, and EdDSA. Use these values when specifying the 'alg' header parameter for signing.

```go
const (
	EdDSA = SignatureAlgorithm("EdDSA")
	HS256 = SignatureAlgorithm("HS256") // HMAC using SHA-256
	HS384 = SignatureAlgorithm("HS384") // HMAC using SHA-384
	HS512 = SignatureAlgorithm("HS512") // HMAC using SHA-512
	RS256 = SignatureAlgorithm("RS256") // RSASSA-PKCS-v1.5 using SHA-256
	RS384 = SignatureAlgorithm("RS384") // RSASSA-PKCS-v1.5 using SHA-384
	RS512 = SignatureAlgorithm("RS512") // RSASSA-PKCS-v1.5 using SHA-512
	ES256 = SignatureAlgorithm("ES256") // ECDSA using P-256 and SHA-256
	ES384 = SignatureAlgorithm("ES384") // ECDSA using P-384 and SHA-384
	ES512 = SignatureAlgorithm("ES512") // ECDSA using P-521 and SHA-512
	PS256 = SignatureAlgorithm("PS256") // RSASSA-PSS using SHA256 and MGF1-SHA256
	PS384 = SignatureAlgorithm("PS384") // RSASSA-PSS using SHA384 and MGF1-SHA384
	PS512 = SignatureAlgorithm("PS512") // RSASSA-PSS using SHA512 and MGF1-SHA512
)
```

--------------------------------

### SignedAndEncrypted

Source: https://pkg.go.dev/github.com/go-jose/go-jose/v4/jwt

Creates a builder for signed-then-encrypted tokens.

```APIDOC
## SignedAndEncrypted

### Description
Creates a builder for signed-then-encrypted tokens. ErrInvalidContentType will be returned if encrypter doesn't have JWT content type.

### Function Signature
```go
func SignedAndEncrypted(sig jose.Signer, enc jose.Encrypter) NestedBuilder
```

### Parameters
- **sig** (jose.Signer) - The signer to use.
- **enc** (jose.Encrypter) - The encrypter to use.

### Returns
- **NestedBuilder** - A builder for signed-then-encrypted tokens.
```

--------------------------------

### CompactSerialize

Source: https://pkg.go.dev/github.com/go-jose/go-jose/v4

Serializes an object using the compact serialization format.

```APIDOC
## CompactSerialize

### Description
Serializes an object using the compact serialization format.

### Function Signature
```go
func (obj JSONWebSignature) CompactSerialize() (string, error)
```

### Parameters
- **obj** (JSONWebSignature) - Required - The JWS object to serialize.

### Returns
- **(string, error)** - The compact serialized string and error if serialization fails.
```

--------------------------------

### SignerOptions Methods

Source: https://pkg.go.dev/github.com/go-jose/go-jose/v4

Methods to configure SignerOptions for JWS signing.

```APIDOC
## [METHOD] WithBase64

### Description
Sets the base64 option for the SignerOptions.

### Function Signature
func (so *SignerOptions) WithBase64(b64 bool) *SignerOptions

### Parameters
- **b64** (bool) - Required - Whether to use base64 encoding.

### Returns
- **SignerOptions** - The updated options.
```

```APIDOC
## [METHOD] WithContentType

### Description
Sets the content type option for the SignerOptions.

### Function Signature
func (so *SignerOptions) WithContentType(contentType ContentType) *SignerOptions

### Parameters
- **contentType** (ContentType) - Required - The content type to set.

### Returns
- **SignerOptions** - The updated options.
```

```APIDOC
## [METHOD] WithCritical

### Description
Sets critical header names for the SignerOptions.

### Function Signature
func (so *SignerOptions) WithCritical(names ...string) *SignerOptions

### Parameters
- **names** (...string) - Required - The critical header names.

### Returns
- **SignerOptions** - The updated options.
```

```APIDOC
## [METHOD] WithHeader

### Description
Sets a custom header key-value pair for the SignerOptions.

### Function Signature
func (so *SignerOptions) WithHeader(k HeaderKey, v interface{}) *SignerOptions

### Parameters
- **k** (HeaderKey) - Required - The header key.
- **v** (interface{}) - Required - The header value.

### Returns
- **SignerOptions** - The updated options.
```

```APIDOC
## [METHOD] WithType

### Description
Sets the type option for the SignerOptions.

### Function Signature
func (so *SignerOptions) WithType(typ ContentType) *SignerOptions

### Parameters
- **typ** (ContentType) - Required - The type to set.

### Returns
- **SignerOptions** - The updated options.
```

--------------------------------

### go-jose v4 JSONWebSignature and Related Types

Source: https://pkg.go.dev/github.com/go-jose/go-jose/v4

Documentation for the go-jose v4 JSONWebSignature type and related interfaces and types.

```APIDOC
## JSONWebSignature.DetachedVerifyMulti

### Description
Validates a detached signature on the given payload with a signature/object that has potentially multiple signers. Returns the index of the signature that was verified, along with the signature object. This is only useful when the payload and signature are separated and the signature can have multiple signers.

### Method
Function

### Signature
`func (obj JSONWebSignature) DetachedVerifyMulti(payload []byte, verificationKey interface{}) (int, Signature, []byte, error)`

### Parameters
- **payload** ([]byte) - Required - The payload to verify.
- **verificationKey** (interface{}) - Required - Must have one of the types allowed for the verificationKey argument of JSONWebSignature.Verify().

### Returns
- **int** - Index of the verified signature.
- **Signature** - The verified signature object.
- **[]byte** - The verified payload.
- **error** - Error if verification fails.
```

```APIDOC
## JSONWebSignature.FullSerialize

### Description
Serializes an object using the full JSON serialization format.

### Method
Function

### Signature
`func (obj JSONWebSignature) FullSerialize() string`

### Returns
- **string** - The full JSON serialization of the object.
```

```APIDOC
## JSONWebSignature.UnsafePayloadWithoutVerification

### Description
Returns the payload without verifying it. The content returned from this function cannot be trusted.

### Method
Function

### Signature
`func (obj JSONWebSignature) UnsafePayloadWithoutVerification() []byte`

### Returns
- **[]byte** - The payload without verification.
```

```APIDOC
## JSONWebSignature.Verify

### Description
Validates the signature on the object and returns the payload. This function does not support multi-signature; use VerifyMulti instead. Be careful when verifying signatures based on embedded JWKs inside the payload header; you cannot assume that the key received in a payload is trusted.

### Method
Function

### Signature
`func (obj JSONWebSignature) Verify(verificationKey interface{}) ([]byte, error)`

### Parameters
- **verificationKey** (interface{}) - Required - Must have one of these types: ed25519.PublicKey, *ecdsa.PublicKey, *rsa.PublicKey, *JSONWebKey, JSONWebKey, *JSONWebKeySet, JSONWebKeySet, []byte (an HMAC key), or any type that implements the OpaqueVerifier interface. If the key is an HMAC key, it must have at least as many bytes as the relevant hash output: HS256: 32 bytes, HS384: 48 bytes, HS512: 64 bytes.

### Returns
- **[]byte** - The verified payload.
- **error** - Error if verification fails.
```

```APIDOC
## JSONWebSignature.VerifyMulti

### Description
Validates (one of the multiple) signatures on the object and returns the index of the signature that was verified, along with the signature object and the payload. We return the signature and index to guarantee that callers are getting the verified value.

### Method
Function

### Signature
`func (obj JSONWebSignature) VerifyMulti(verificationKey interface{}) (int, Signature, []byte, error)`

### Parameters
- **verificationKey** (interface{}) - Required - Must have one of the types allowed for the verificationKey argument of JSONWebSignature.Verify().

### Returns
- **int** - Index of the verified signature.
- **Signature** - The verified signature object.
- **[]byte** - The verified payload.
- **error** - Error if verification fails.
```

```APIDOC
## KeyAlgorithm

### Description
KeyAlgorithm represents a key management algorithm.

### Type
`type KeyAlgorithm string`
```

```APIDOC
## NonceSource

### Description
NonceSource represents a source of random nonces to go into JWS objects.

### Type
`type NonceSource interface { Nonce() (string, error) }`

### Methods
- **Nonce()** (string, error) - Returns a random nonce.
```

```APIDOC
## OpaqueKeyDecrypter

### Description
OpaqueKeyDecrypter is an interface that supports decrypting keys with an opaque key.

### Type
`type OpaqueKeyDecrypter interface { DecryptKey(encryptedKey []byte, header Header) ([]byte, error) }`

### Methods
- **DecryptKey(encryptedKey []byte, header Header)** ([]byte, error) - Decrypts an encrypted key.
```

```APIDOC
## OpaqueKeyEncrypter

### Description
OpaqueKeyEncrypter is an interface that supports encrypting keys with an opaque key. Note: this cannot currently be implemented outside this package because of its unexported method.

### Type
`type OpaqueKeyEncrypter interface { KeyID() string; Algs() []KeyAlgorithm }`

### Methods
- **KeyID()** string - Returns the kid.
- **Algs()** []KeyAlgorithm - Returns a list of supported key encryption algorithms.
```

```APIDOC
## OpaqueSigner

### Description
OpaqueSigner is an interface that supports signing payloads with opaque private key(s). Private key operations performed by implementers may, for example, occur in a hardware module. An OpaqueSigner may rotate signing keys transparently to the user of this interface.

### Type
`type OpaqueSigner interface { Public() *JSONWebKey; Algs() []SignatureAlgorithm; SignPayload(payload []byte, alg SignatureAlgorithm) ([]byte, error) }`

### Methods
- **Public()** *JSONWebKey - Returns the public key of the current signing key.
- **Algs()** []SignatureAlgorithm - Returns a list of supported signing algorithms.
- **SignPayload(payload []byte, alg SignatureAlgorithm)** ([]byte, error) - Signs a payload with the current signing key using the given algorithm.
```

```APIDOC
## OpaqueVerifier

### Description
OpaqueVerifier is an interface that supports verifying payloads with opaque public key(s). An OpaqueSigner may rotate signing keys transparently to the user of this interface.

### Type
`type OpaqueVerifier interface { VerifyPayload(payload []byte, signature []byte, alg SignatureAlgorithm) error }`

### Methods
- **VerifyPayload(payload []byte, signature []byte, alg SignatureAlgorithm)** error - Verifies a payload with the given signature and algorithm.
```

```APIDOC
## Recipient

### Description
Recipient represents a recipient of a JWE message.

### Type
`type Recipient struct { Algorithm KeyAlgorithm; Key interface{}; KeyID string; PBES2Count int }`

### Fields
- **Algorithm** (KeyAlgorithm) - The key management algorithm.
- **Key** (interface{}) - Must have one of these types: ed25519.PublicKey, *ecdsa.PublicKey, *rsa.PublicKey, *JSONWebKey, JSONWebKey, []byte (a symmetric key), or any type that satisfies the OpaqueKeyEncrypter interface. The type of Key must match the value of Algorithm.
- **KeyID** (string) - The key ID.
- **PBES2Count** (int) - The PBES2 count.
```

--------------------------------

### func (Header) Certificates

Source: https://pkg.go.dev/github.com/go-jose/go-jose/v4

Verifies and returns the certificate chain present in the x5c header field of a message, if one was present. Returns an error if there was no x5c header present or the chain could not be validated with the given verify options.

```APIDOC
## func (Header) Certificates

### Description
Verifies and returns the certificate chain present in the x5c header field of a message, if one was present. Returns an error if there was no x5c header present or the chain could not be validated with the given verify options.

### Signature
func (h Header) Certificates(opts x509.VerifyOptions) ([][]*x509.Certificate, error)

### Parameters
- **opts** (x509.VerifyOptions) - Required - The verification options to use for validating the certificate chain.

### Returns
- **[][]*x509.Certificate** - The certificate chain(s) from the x5c header.
- **error** - An error if the chain is missing or invalid.
```

--------------------------------

### Package Functions

Source: https://pkg.go.dev/github.com/go-jose/go-jose/v4/json

Functions for compacting, escaping, indenting, marshaling, and unmarshaling JSON data.

```APIDOC
## func Compact

### Description
Compact appends to dst the JSON-encoded src with insignificant space characters elided.

### Signature
func Compact(dst *bytes.Buffer, src []byte) error

### Parameters
- **dst** (*bytes.Buffer) - Required - Destination buffer to append the compacted JSON to.
- **src** ([]byte) - Required - Source JSON bytes to compact.

### Returns
- **error** - An error if compaction fails.
```

```APIDOC
## func HTMLEscape

### Description
HTMLEscape appends to dst the JSON-encoded src with <, >, &, U+2028 and U+2029 characters inside string literals changed to \u003c, \u003e, \u0026, \u2028, \u2029 so that the JSON will be safe to embed inside HTML <script> tags.

### Signature
func HTMLEscape(dst *bytes.Buffer, src []byte)

### Parameters
- **dst** (*bytes.Buffer) - Required - Destination buffer to append the escaped JSON to.
- **src** ([]byte) - Required - Source JSON bytes to escape.
```

```APIDOC
## func Indent

### Description
Indent appends to dst an indented form of the JSON-encoded src. Each element in a JSON object or array begins on a new, indented line beginning with prefix followed by one or more copies of indent according to the indentation nesting.

### Signature
func Indent(dst *bytes.Buffer, src []byte, prefix, indent string) error

### Parameters
- **dst** (*bytes.Buffer) - Required - Destination buffer to append the indented JSON to.
- **src** ([]byte) - Required - Source JSON bytes to indent.
- **prefix** (string) - Required - Prefix to prepend to each new line.
- **indent** (string) - Required - Indentation string to use for each nesting level.

### Returns
- **error** - An error if indentation fails.
```

```APIDOC
## func Marshal

### Description
Marshal returns the JSON encoding of v.

### Signature
func Marshal(v interface{}) ([]byte, error)

### Parameters
- **v** (interface{}) - Required - Value to marshal to JSON.

### Returns
- **[]byte** - The JSON-encoded bytes.
- **error** - An error if marshaling fails.
```

```APIDOC
## func MarshalIndent

### Description
MarshalIndent is like Marshal but applies Indent to format the output.

### Signature
func MarshalIndent(v interface{}, prefix, indent string) ([]byte, error)

### Parameters
- **v** (interface{}) - Required - Value to marshal to JSON.
- **prefix** (string) - Required - Prefix to prepend to each new line.
- **indent** (string) - Required - Indentation string to use for each nesting level.

### Returns
- **[]byte** - The JSON-encoded bytes.
- **error** - An error if marshaling fails.
```

```APIDOC
## func Unmarshal

### Description
Unmarshal parses the JSON-encoded data and stores the result in the value pointed to by v.

### Signature
func Unmarshal(data []byte, v interface{}) error

### Parameters
- **data** ([]byte) - Required - JSON-encoded data to parse.
- **v** (interface{}) - Required - Pointer to the value to store the result in.

### Returns
- **error** - An error if unmarshaling fails.
```

--------------------------------

### Encrypt plaintext with jose-util

Source: https://pkg.go.dev/github.com/go-jose/go-jose/v4/jose-util

Encrypts plaintext using the specified key and algorithms. The --alg flag specifies the key management algorithm (e.g., RSA-OAEP) and --enc specifies the content encryption algorithm (e.g., A128GCM). Input and output can be from stdin/stdout or files.

```bash
# From stdin, to stdout
jose-util encrypt --key public-key.pem --alg RSA-OAEP --enc A128GCM

# Operating on files
jose-util encrypt --key public-key.pem --alg RSA-OAEP --enc A128GCM --in plaintext.txt --out ciphertext.txt

```

--------------------------------

### Header.Certificates

Source: https://pkg.go.dev/github.com/go-jose/go-jose/v4

Method to retrieve certificates from a Header.

```APIDOC
## [METHOD] Certificates

### Description
Returns the certificates from the Header.

### Function Signature
func (h Header) Certificates(opts x509.VerifyOptions) ([][]*x509.Certificate, error)

### Parameters
- **opts** (x509.VerifyOptions) - Required - Verification options.

### Returns
- **[][]*x509.Certificate** - The certificates.
- **error** - An error if verification fails.
```

--------------------------------

### JSONWebKey.Public

Source: https://pkg.go.dev/github.com/go-jose/go-jose/v4

Creates a JSONWebKey with the corresponding public key if the JWK represents an asymmetric private key.

```APIDOC
## JSONWebKey.Public

### Description
Creates JSONWebKey with corresponding public key if JWK represents asymmetric private key.

### Method
Public

### Signature
func (k *JSONWebKey) Public() JSONWebKey

### Returns
- **JSONWebKey** - The public key representation.
```

--------------------------------

### KeyWrap

Source: https://pkg.go.dev/github.com/go-jose/go-jose/v4/cipher

Implements NIST key wrapping; it wraps a content encryption key (cek) with the given block cipher.

```APIDOC
## KeyWrap

### Description
Implements NIST key wrapping; it wraps a content encryption key (cek) with the given block cipher.

### Function Signature
```go
func KeyWrap(block cipher.Block, cek []byte) ([]byte, error)
```

### Parameters
- **block** (cipher.Block) - Required - The block cipher to use for wrapping.
- **cek** ([]byte) - Required - The content encryption key to wrap.

### Returns
- **[]byte** - The wrapped key.
- **error** - An error if wrapping fails.
```

--------------------------------

### NewMultiEncrypter

Source: https://pkg.go.dev/github.com/go-jose/go-jose/v4

Creates a multi-encrypter based on the given parameters.

```APIDOC
## NewMultiEncrypter

### Description
Creates a multi-encrypter based on the given parameters.

### Signature
func NewMultiEncrypter(enc ContentEncryption, rcpts []Recipient, opts *EncrypterOptions) (Encrypter, error)

### Parameters
- **enc** (ContentEncryption) - Required - The content encryption algorithm.
- **rcpts** ([]Recipient) - Required - The list of recipients.
- **opts** (*EncrypterOptions) - Optional - Options for the encrypter.

### Returns
- **Encrypter** - A multi-encrypter that produces an encrypted JWE object.
- **error** - An error if the encrypter could not be created.

```

--------------------------------

### func (JSONWebEncryption) CompactSerialize

Source: https://pkg.go.dev/github.com/go-jose/go-jose/v4

Serializes an object using the compact serialization format.

```APIDOC
## func (JSONWebEncryption) CompactSerialize

### Description
Serializes an object using the compact serialization format.

### Signature
func (obj JSONWebEncryption) CompactSerialize() (string, error)

### Returns
- **string** - The serialized JWE in compact format.
- **error** - An error if serialization fails.
```

--------------------------------

### Encrypted

Source: https://pkg.go.dev/github.com/go-jose/go-jose/v4/jwt

Constructor for creating an encrypted JWT builder.

```APIDOC
## [FUNCTION] Encrypted

### Description
Creates a Builder that will produce an encrypted JWT using the provided encrypter.

### Signature
func Encrypted(enc jose.Encrypter) Builder

### Parameters
- **enc** (jose.Encrypter) - The encrypter used to encrypt the token.

### Returns
- **Builder** - A Builder for constructing the encrypted token.
```

--------------------------------

### func (*Decoder) More() bool

Source: https://pkg.go.dev/github.com/go-jose/go-jose/v4/json

Reports whether there is another element in the current array or object being parsed.

```APIDOC
## func (*Decoder) More

### Description
More reports whether there is another element in the current array or object being parsed.

### Function Signature
```go
func (dec *Decoder) More() bool
```

### Parameters
- **dec** (*Decoder) - Required - The decoder instance.

### Return Value
- **bool** - True if there is another element, false otherwise.

```

--------------------------------

### SignedAndEncrypted

Source: https://pkg.go.dev/github.com/go-jose/go-jose/v4/jwt

Constructor for creating a nested signed and encrypted JWT builder.

```APIDOC
## [FUNCTION] SignedAndEncrypted

### Description
Creates a NestedBuilder for producing a nested signed and encrypted JWT.

### Signature
func SignedAndEncrypted(sig jose.Signer, enc jose.Encrypter) NestedBuilder

### Parameters
- **sig** (jose.Signer) - The signer for the inner token.
- **enc** (jose.Encrypter) - The encrypter for the outer token.

### Returns
- **NestedBuilder** - A builder for nested tokens.
```

--------------------------------

### NewNumericDate

Source: https://pkg.go.dev/github.com/go-jose/go-jose/v4/jwt

Constructor for creating a NumericDate from a time.

```APIDOC
## [FUNCTION] NewNumericDate

### Description
Creates a new NumericDate from a time.Time.

### Signature
func NewNumericDate(t time.Time) *NumericDate

### Parameters
- **t** (time.Time) - The time to convert.

### Returns
- **\*NumericDate** - A pointer to the new NumericDate.
```

--------------------------------

### Expected.WithTime

Source: https://pkg.go.dev/github.com/go-jose/go-jose/v4/jwt

Method to set the time in an Expected struct.

```APIDOC
## [FUNCTION] Expected.WithTime

### Description
Returns a copy of the Expected with the time set to the provided time.

### Signature
func (e Expected) WithTime(t time.Time) Expected

### Parameters
- **t** (time.Time) - The time to set.

### Returns
- **Expected** - A copy of the Expected with the time set.
```

--------------------------------

### func (*EncrypterOptions) WithHeader

Source: https://pkg.go.dev/github.com/go-jose/go-jose/v4

Adds an arbitrary value to the ExtraHeaders map, initializing it if necessary, and returns the updated EncrypterOptions. The value will be serialized by json.Marshal and must be a valid input to that function.

```APIDOC
## func (*EncrypterOptions) WithHeader

### Description
Adds an arbitrary value to the ExtraHeaders map, initializing it if necessary, and returns the updated EncrypterOptions. The value will be serialized by json.Marshal and must be a valid input to that function.

### Signature
func (eo *EncrypterOptions) WithHeader(k HeaderKey, v interface{}) *EncrypterOptions

### Parameters
- **k** (HeaderKey) - Required - The header key to set.
- **v** (interface{}) - Required - The value to set for the header key. Must be a valid input to json.Marshal.

### Returns
- **\*EncrypterOptions** - The updated EncrypterOptions.
```
Tokens:
Raw