---
product: Chilkat
product_version: 11.7.0
language: ckruby
language_label: Ruby
class: Jwt
class_name: CkJwt
license: bundle
deprecated: false
reference_html: https://www.chilkatsoft.com/refdoc/rubyCkJwtRef.html
---
# Chilkat Jwt — Ruby — v11.7.0

> Chilkat 11.7.0 · language=ckruby · class=Jwt (CkJwt)
> Other versions: replace `11.7.0` in this URL. Other languages: `https://www.chilkatsoft.com/ai-docs/v/11.7.0/<lang>/classes/Jwt.md`.
> Language-wide rules (install, unlock, error model, strings/bytes): `https://www.chilkatsoft.com/ai-docs/v/11.7.0/ckruby/guide.md`.

## Purpose

**Create, decode, verify, and time-validate compact JSON Web Tokens.**

`Chilkat.Jwt` is the Chilkat class for working with compact JSON Web Tokens. It can create signed JWTs, decode JWT headers and payloads, verify signatures, validate time-based claims, generate NumericDate values, and work with HMAC shared-secret tokens, RSA public/private-key tokens, ECC public/private-key tokens, and certificate-backed signing workflows.

**Create compact JWTs**

Build JWTs from JSON header and payload data, then sign them using the algorithm and key material required by the application or API.

**Decode headers and claims**

Decode the JWT header and payload without verification when an application needs to inspect claims, algorithms, key IDs, or token metadata.

**Verify signatures**

Verify JWT signatures using HMAC shared secrets, RSA public keys, ECC public keys, or certificates.

**Sign with keys or certs**

Create tokens using shared secrets, private keys, or certificates that have access to the associated private key.

**Time validation**

Validate `exp` and `nbf` claims and generate NumericDate values for token expiration, not-before, and issued-at timestamps.

**API authentication workflows**

Use JWTs for bearer-token style authentication, service-account flows, assertion-based OAuth flows, and other compact token formats.

**Common pattern:** To create a JWT, prepare the JSON header and payload, set claims such as `iss`, `sub`, `aud`, `iat`, `nbf`, or `exp`, then sign with the required shared secret, private key, or certificate. To consume a JWT, decode it as needed, verify the signature with the matching key, and separately validate the time-based claims required by the application.

For an extended overview, see [Jwt Class Overview](https://www.chilkatsoft.com/jwt_class_overview.asp).

## Object creation, unlocking and error handling

**Object Creation**

```ruby
obj = Chilkat::CkJwt.new()
```

Call `Global.UnlockBundle` once at the start of the program, before using this or any other Chilkat class. Any string unlocks a fully functional 30-day trial; a purchased unlock code is used in production. See `guide.md` for the exact code in Ruby.

How failure is reported depends on the method's return type and is stated in the note under each method below. In every case the diagnostic text is in the `LastErrorText` property of the object whose method was called.

## Members common to every Chilkat class

Documented once per language in `common-members.md`; listed here so this page is self-contained.

| Property | Signature | Access | Meaning |
|---|---|---|---|
| `DebugLogFilePath` | `# strVal is a string # ckStr is a CkString jwt.get_DebugLogFilePath(ckStr); strVal = jwt.debugLogFilePath(); jwt.put_DebugLogFilePath(strVal);` | read/write | If set to a file path, this property logs the LastErrorText of each Chilkat method or property call to the specified file. |
| `LastErrorHtml` | `# strVal is a string # ckStr is a CkString jwt.get_LastErrorHtml(ckStr); strVal = jwt.lastErrorHtml();` | read-only | Provides HTML-formatted information about the last called method or property. |
| `LastErrorText` | `# strVal is a string # ckStr is a CkString jwt.get_LastErrorText(ckStr); strVal = jwt.lastErrorText();` | read-only | Provides plain text information about the last called method or property. |
| `LastErrorXml` | `# strVal is a string # ckStr is a CkString jwt.get_LastErrorXml(ckStr); strVal = jwt.lastErrorXml();` | read-only | Provides XML-formatted information about the last called method or property. |
| `LastMethodSuccess` | `# boolVal is a boolean boolVal = jwt.get_LastMethodSuccess(); jwt.put_LastMethodSuccess(boolVal);` | read/write | Indicates the success or failure of the most recent method call: `true` means success, `false` means failure. |
| `Utf8` | `# boolVal is a boolean boolVal = jwt.get_Utf8(); jwt.put_Utf8(boolVal);` | read/write | When set to `true`, all `string` arguments and return values are interpreted as UTF-8 strings. |
| `VerboseLogging` | `# boolVal is a boolean boolVal = jwt.get_VerboseLogging(); jwt.put_VerboseLogging(boolVal);` | read/write | If set to `true`, then the contents of LastErrorText (or LastErrorXml, or LastErrorHtml) may contain more verbose information. |
| `Version` | `# strVal is a string # ckStr is a CkString jwt.get_Version(ckStr); strVal = jwt.version();` | read-only | Version of the component/library, such as "10.1.0" |

## Member index

| Member | Kind | Signature |
|---|---|---|
| `AutoCompact` | property, read/write | `# boolVal is a boolean boolVal = jwt.get_AutoCompact(); jwt.put_AutoCompact(boolVal);` |
| `UncommonOptions` | property, read/write | `# strVal is a string # ckStr is a CkString jwt.get_UncommonOptions(ckStr); strVal = jwt.uncommonOptions(); jwt.put_UncommonOptions(strVal);` |
| `CreateJwt` | method | `# header is a string # payload is a string # password is a string # outStr is a CkString (output) status = jwt.CreateJwt(header, payload, password, outStr); retStr = jwt.createJwt(header, payload, password);` |
| `CreateJwtCert` | method | `# header is a string # payload is a string # cert is a CkCert # outStr is a CkString (output) status = jwt.CreateJwtCert(header, payload, cert, outStr); retStr = jwt.createJwtCert(header, payload, cert);` |
| `CreateJwtPk` | method | `# header is a string # payload is a string # key is a CkPrivateKey # outStr is a CkString (output) status = jwt.CreateJwtPk(header, payload, key, outStr); retStr = jwt.createJwtPk(header, payload, key);` |
| `GenNumericDate` | method | `# numSecOffset is an integer retInt = jwt.GenNumericDate(numSecOffset);` |
| `GetHeader` | method | `# token is a string # outStr is a CkString (output) status = jwt.GetHeader(token, outStr); retStr = jwt.getHeader(token);` |
| `GetPayload` | method | `# token is a string # outStr is a CkString (output) status = jwt.GetPayload(token, outStr); retStr = jwt.getPayload(token);` |
| `IsTimeValid` | method | `# jwt is a string # leeway is an integer retBool = jwt.IsTimeValid(jwt, leeway);` |
| `VerifyJwt` | method | `# token is a string # password is a string status = jwt.VerifyJwt(token, password);` |
| `VerifyJwtPk` | method | `# token is a string # key is a CkPublicKey status = jwt.VerifyJwtPk(token, key);` |

## Properties

### Jwt.AutoCompact

`Chilkat 11.7.0 · ckruby · Jwt · AutoCompact · property · read/write · since 9.5.0.58`

```ruby
# boolVal is a boolean

boolVal = jwt.get_AutoCompact();

jwt.put_AutoCompact(boolVal);
```

Controls whether Chilkat removes insignificant JSON whitespace from the `header` and `payload` passed to `CreateJwt` and `CreateJwtPk` before Base64URL encoding and signing. The default is `true`.

Compaction reduces token size without changing the JSON data model. Because the exact header and payload bytes are part of the signing input, changing this property changes the encoded token and its signature even when the JSON values are equivalent.

**Whitespace inside JSON strings is preserved:** Compaction removes formatting whitespace between JSON tokens; it does not remove spaces that are part of a quoted string value.

### Jwt.UncommonOptions

`Chilkat 11.7.0 · ckruby · Jwt · UncommonOptions · property · read/write · since 10.1.0`

```ruby
# strVal is a string

# ckStr is a CkString

jwt.get_UncommonOptions(ckStr);

strVal = jwt.uncommonOptions();

jwt.put_UncommonOptions(strVal);
```

Provides a catch-all string for specialized compatibility options that are not exposed as ordinary properties. The default is the empty string, which is appropriate for normal use.

**Leave empty unless instructed:** Set this property only when a Chilkat example, release note, or support response documents a specific option needed for an unusual interoperability case.

## Methods

### Jwt.CreateJwt

`Chilkat 11.7.0 · ckruby · Jwt · CreateJwt · method · since 9.5.0.58`

```ruby
# header is a string

# payload is a string

# password is a string

# outStr is a CkString (output)

status = jwt.CreateJwt(header, payload, password, outStr);

retStr = jwt.createJwt(header, payload, password);
```

Creates a signed JWT using an HMAC shared secret. `header` may be a complete JOSE header JSON object or the shorthand `HS256`, `HS384`, or `HS512`. A shorthand value produces a standard header containing the corresponding `alg` value.

`payload` is the JSON claims set. Chilkat signs the JSON supplied by the application; it does not automatically add claims such as `iss`, `sub`, `aud`, `iat`, `nbf`, or `exp`. `password` is the shared secret used by both the signer and verifier.

| Algorithm | Operation |
| :--- | :--- |
| `HS256` | HMAC with SHA-256. |
| `HS384` | HMAC with SHA-384. |
| `HS512` | HMAC with SHA-512. |

On success, the result is a compact JWS in the form `base64url(header).base64url(payload).base64url(signature)`. The Base64URL segments do not use padding.

**Signed, not encrypted:** Anyone who receives the token can decode its header and payload. The HMAC protects integrity and authenticity only; do not place confidential information in the claims unless the token is protected separately.

**Shared-secret guidance:** Use a high-entropy secret appropriate for the selected HMAC algorithm. A human password is usually weaker than a randomly generated key. Use `CreateJwtPk` when the trust model requires an asymmetric private key.

Returns true for success, false for failure.

### Jwt.CreateJwtCert

`Chilkat 11.7.0 · ckruby · Jwt · CreateJwtCert · method · since 9.5.0.99`

```ruby
# header is a string

# payload is a string

# cert is a CkCert

# outStr is a CkString (output)

status = jwt.CreateJwtCert(header, payload, cert, outStr);

retStr = jwt.createJwtCert(header, payload, cert);
```

Creates a signed JWT using the private key associated with `cert`. The certificate must provide access to an RSA or EC private key compatible with the `alg` value in `header`.

`header` may be a complete JOSE header JSON object or the shorthand `RS256`, `RS384`, `RS512`, `PS256`, `PS384`, `PS512`, `ES256`, `ES384`, or `ES512`. `payload` is the JSON claims set. PS256/384/512 support was added in Chilkat v10.0.0.

On success, the result is a compact JWS in the form `base64url(header).base64url(payload).base64url(signature)`.

**Private-key access is required:** A certificate containing only the public key cannot create a signature. Signing can also fail when the private key exists but is not accessible, is nonfunctional, requires unavailable user interaction, or is incompatible with the selected algorithm.

**Certificate trust is a verifier decision:** Creating a JWT with a certificate-backed key does not by itself establish that recipients should trust that certificate. The verifier must obtain the correct public key or certificate through a trusted mechanism and apply any required certificate validation policy.

Returns true for success, false for failure.

### Jwt.CreateJwtPk

`Chilkat 11.7.0 · ckruby · Jwt · CreateJwtPk · method · since 9.5.0.58`

```ruby
# header is a string

# payload is a string

# key is a CkPrivateKey

# outStr is a CkString (output)

status = jwt.CreateJwtPk(header, payload, key, outStr);

retStr = jwt.createJwtPk(header, payload, key);
```

Creates a signed JWT using an asymmetric private key. `header` may be a complete JOSE header JSON object or one of the documented shorthand algorithm names. `payload` is the JSON claims set, and `key` must be a private key compatible with the selected `alg`.

| JOSE algorithm | Required key and signature scheme |
| :--- | :--- |
| `RS256`, `RS384`, `RS512` | RSA private key; RSASSA-PKCS1-v1_5 with the corresponding SHA-2 digest. |
| `PS256`, `PS384`, `PS512` | RSA private key; RSASSA-PSS with the corresponding SHA-2 digest and MGF1. |
| `ES256`, `ES384`, `ES512` | EC private key compatible with the requested ECDSA algorithm. |
| `EdDSA` | Ed25519 private key. Use a full JOSE header containing `"alg":"EdDSA"`. |

The shorthand forms documented for this method are `RS256`, `RS384`, `RS512`, `PS256`, `PS384`, `PS512`, `ES256`, `ES384`, and `ES512`. PS256/384/512 support was added in Chilkat v10.0.0; Ed25519 signing with `EdDSA` requires Chilkat v9.5.0.95 or later.

On success, the result is a compact JWS in the form `base64url(header).base64url(payload).base64url(signature)`.

**Key compatibility:** The private-key type must agree with `alg`. Do not select an algorithm solely from untrusted input. Choose the algorithm as part of the application protocol and use a key intended for that algorithm.

**Claims remain application-defined:** This method creates the cryptographic signature. The application is responsible for constructing and later validating issuer, audience, subject, lifetime, nonce, and other required claims.

Returns true for success, false for failure.

### Jwt.GenNumericDate

`Chilkat 11.7.0 · ckruby · Jwt · GenNumericDate · method · since 9.5.0.58`

```ruby
# numSecOffset is an integer

retInt = jwt.GenNumericDate(numSecOffset);
```

Returns a JWT *NumericDate* equal to the current system time plus `numSecOffset`. The result is the number of whole seconds elapsed since `1970-01-01T00:00:00Z`, ignoring leap seconds.

A positive offset produces a future time and a negative offset produces a past time. Typical uses include generating values for `iat`, `nbf`, and `exp` claims. The method returns the numeric value only; it does not insert the value into a JSON payload.

**System-clock dependency:** The result is based on the computer's current clock. Token lifetimes and validation can be incorrect when the system clock is inaccurate.

### Jwt.GetHeader

`Chilkat 11.7.0 · ckruby · Jwt · GetHeader · method · since 9.5.0.58`

```ruby
# token is a string

# outStr is a CkString (output)

status = jwt.GetHeader(token, outStr);

retStr = jwt.getHeader(token);
```

Decodes and returns the JOSE header JSON from the first segment of the compact JWT. For a token in the form `header.payload.signature`, this method Base64URL-decodes the `header` segment and interprets it as JSON text.

**No verification is performed:** Decoding a header does not prove that the token is authentic. Until `VerifyJwt` or `VerifyJwtPk` succeeds, treat every header value—including `alg`, `kid`, `jku`, and `x5u`—as attacker-controlled input.

The method fails if the token does not contain a decodable compact-JWT header.

Returns true for success, false for failure.

### Jwt.GetPayload

`Chilkat 11.7.0 · ckruby · Jwt · GetPayload · method · since 9.5.0.58`

```ruby
# token is a string

# outStr is a CkString (output)

status = jwt.GetPayload(token, outStr);

retStr = jwt.getPayload(token);
```

Decodes and returns the claims-set JSON from the second segment of the compact JWT. For a token in the form `header.payload.signature`, this method Base64URL-decodes the `payload` segment and returns the resulting JSON text.

**Decoding is not validation:** This method does not verify the signature, token lifetime, issuer, audience, nonce, or any other claim. Use the appropriate signature-verification method first, then apply the claim checks required by the application.

The method fails if the token does not contain a decodable compact-JWT payload.

Returns true for success, false for failure.

### Jwt.IsTimeValid

`Chilkat 11.7.0 · ckruby · Jwt · IsTimeValid · method · since 9.5.0.58`

```ruby
# jwt is a string

# leeway is an integer

retBool = jwt.IsTimeValid(jwt, leeway);
```

Checks the JWT `exp` (expiration time) and `nbf` (not before) claims against the current system time. It returns `true` when every present time constraint permits the token to be used, and `false` when the token is expired, is not yet valid, or its relevant time data cannot be processed.

| Claim | Validity rule |
| :--- | :--- |
| `exp` | The token is not accepted on or after the expiration time. |
| `nbf` | The token is not accepted before the not-before time. |

`leeway` is a number of seconds allowed for clock skew. Keep it small; a few minutes is typical. The method checks whichever of `exp` and `nbf` are present and does not require either claim to exist.

**Time checking is separate from signature verification:** `IsTimeValid` does not verify the JWT signature and does not validate `iss`, `aud`, `sub`, `iat`, `jti`, nonce values, or application-specific claims. A normal validation workflow verifies the signature, checks time constraints, and then validates all required claims.

### Jwt.VerifyJwt

`Chilkat 11.7.0 · ckruby · Jwt · VerifyJwt · method · since 9.5.0.58`

```ruby
# token is a string

# password is a string

status = jwt.VerifyJwt(token, password);
```

Verifies the signature of a compact JWT signed with the shared secret in `password`. This method accepts only the HMAC algorithms `HS256`, `HS384`, and `HS512`. It rejects `none` and algorithms intended for asymmetric keys.

Chilkat reads the token's `alg` value, computes the corresponding HMAC over the encoded header and payload, and compares the result with the signature segment. The method returns `true` only when the signature matches.

**Signature verification only:** A successful result does not validate expiration, not-before time, issuer, audience, subject, or any other claim. Call `IsTimeValid` and perform the application's required claim checks separately.

**Enforce the expected algorithm:** Applications should inspect the verified header and require the specific HMAC algorithm allowed by their protocol rather than accepting any algorithm merely because this method supports it.

Returns true for success, false for failure.

### Jwt.VerifyJwtPk

`Chilkat 11.7.0 · ckruby · Jwt · VerifyJwtPk · method · since 9.5.0.58`

```ruby
# token is a string

# key is a CkPublicKey

status = jwt.VerifyJwtPk(token, key);
```

Verifies the signature of a compact JWT using `key`. The public key must match the private key that created the signature and must be compatible with the algorithm named by the token's `alg` header.

| JOSE algorithm | Verification key |
| :--- | :--- |
| `RS256`, `RS384`, `RS512` | RSA public key for RSASSA-PKCS1-v1_5. |
| `PS256`, `PS384`, `PS512` | RSA public key for RSASSA-PSS. |
| `ES256`, `ES384`, `ES512` | EC public key compatible with the ECDSA algorithm. |
| `EdDSA` | Ed25519 public key. Ed25519 verification requires Chilkat v9.5.0.84 or later. |

The method returns `true` only when the signature is valid. It returns `false` for a malformed token, unsupported or incompatible algorithm/key combination, incorrect key, or invalid signature. The unsecured `none` algorithm is rejected.

**Use a trusted key-selection process:** Do not automatically trust a key URL or key identifier taken from an unverified JWT header. Select the verification key from trusted configuration or a securely obtained and validated key set, and enforce the expected algorithm.

**Claims are not checked:** Signature validity proves only that the token was signed by the holder of the corresponding private key and was not modified. Validate time, issuer, audience, nonce, and all other required claims separately.

Returns true for success, false for failure.

## Related classes

[`Cert`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/ckruby/classes/Cert.md), [`PrivateKey`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/ckruby/classes/PrivateKey.md), [`PublicKey`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/ckruby/classes/PublicKey.md)