JOSE-JWK-USE(1)

📦
version 15 · 13 versions
, in arch rolling

💅 jose-jwk-use(1) — the manual page, bestie edition

okay so this is the jose-jwk-use(1) page and honestly it's lowkey one of the most useful little gremlins in the whole jose toolbox. it's all about asking a key politely (or not so politely) whether it's allowed to do a thing. let's get into it 🎀

✨ NAME ✨

jose-jwk-use — validates a key for the specified use(s). that's it. that's the whole vibe check. 💅

🌸 SYNOPSIS 🌸

jose jwk use -i JWK [-a] [-r] -u OP

🦋 OVERVIEW 🦋

okay so picture this: the jose jwk use command validates one or more JWK(Set) inputs for a given set of usages. and how does it validate them, you ask? it checks them against the "use" and "key_ops" properties of each JWK. that's the whole assignment. 📝

by default, if a JWK has no restrictions, an operation will be allowed. like, no rules means no problem, the key is just out here living its life freely. ✨ however — and this is the important part, bestie, don't skip it — if you specify the -r option, you can ensure that a JWK will not be allowed unless it explicitly permits the option. so instead of "no restrictions = sure go ahead", it becomes "no explicit permission = absolutely not, ma'am." 🙅‍♀️

in normal operation, jose jwk use will fail if any of the JWKs do not validate. like, the whole thing just gives up. 😭 but! if the -o option is used, jose jwk use will instead write a JWK(Set) containing all of the input keys that validate. it's like a little bouncer at the club, checking IDs and only letting the valid ones inside. 🎟️ and if no JWKs validate? the command will fail. empty club, party's over, lights on. 💀

🌈 OPTIONS 🌈

  • -i JSON, --input=JSON — parse JWK(Set) from JSON. you're handing it the actual JSON right there on the command line, no file needed bestie 💖
  • -i FILE, --input=FILE — read JWK(Set) from FILE. the classic. the standard. the "i saved it to disk like a responsible person" move 📁
  • -i -, --input=- — read JWK(Set) from standard input. that lil - means stdin, iykyk 🫶
  • -u sign, --use=sign — validate the key for signing ✍️
  • -u verify, --use=verify — validate the key for verifying 🔍
  • -u encrypt, --use=encrypt — validate the key for encrypting 🔐
  • -u decrypt, --use=decrypt — validate the key for decrypting 🔓
  • -u wrapKey, --use=wrapKey — validate the key for wrapping 🎁
  • -u unwrapKey, --use=unwrapKey — validate the key for unwrapping 🎀
  • -u deriveKey, --use=deriveKey — validate the key for deriving keys 🌱
  • -u deriveBits, --use=deriveBits — validate the key for deriving bits ⚡
  • -a, --all — succeeds only if all operations are allowed. all of them. every single one. no stragglers. 👑
  • -r, --required — operations must be explicitly allowed. like we said up top, no explicit permission means no deal 🚫
  • -o FILE, --output=FILE — filter keys to FILE as JWK(Set). only the survivors get written out 💾
  • -o -, --output=- — filter keys to standard output as JWK(Set). yep, - again, this time it's stdout 💬
  • -s, --set — always output a JWKSet. no matter what. set energy only. 🧺

🍓 EXAMPLES 🍓

here's what success and failure look like, using a private key and a public key. watch the exit codes, they're the whole story ngl 👀

$ jose jwk gen -i '{"alg":"ES256"}' -o prv.jwk
$ jose jwk pub -i prv.jwk -o pub.jwk
$ jose jwk use -i prv.jwk -u sign
$ echo $?
0
$ jose jwk use -i pub.jwk -u sign
$ echo $?
1

see that? the private key said "yes bestie, i can sign" and gave us 0. the public key said "absolutely not, i'm the public one" and gave us 1. iconic behaviour from both of them honestly 💀✨

💜 AUTHOR 💜

Nathaniel McCallum <npmccallum@redhat.com> — the main character who wrote this 🫶

⭐ SEE ALSO ⭐

okay that's the whole page, you ate that, periodt. 🧚 this was jose-jwk-use(1), dated 06/09/2026, and you can find it filed under the JOSE-JWK-USE(1) manual. mwah, go validate some keys 💖🎀🦋

📦 where this page comes from