JWT-GENERATE(1)

✨ NAME ✨

jwt-generate — bestie, this generates a JSON Web Token 💅

(it's the LibJWT C Library one, in case you were wondering which manual you wandered into 🎀)

---

🌈 SYNOPSIS 🌈

jwt-generate [options]

That's literally it. No subcommands, no drama. Just vibes and flags. 👑

---

💖 DESCRIPTION 💖

Okay so jwt-generate makes a JSON Web Token and, if you want, signs it. Main character energy, honestly.

By default? It just encodes a JWT. That's it. No signature, no nothing. If you want a signature, you have to hand it a JWK key with the -k option. And here's the thing — generating a signature means you gotta specify the algorithm, so it either lives in the key file (as the alg attribute) or you pass it on the command line with -a.

⚠️ If -a is specified and the key has an alg attribute, they must match. They must match. They MUST match. No fighting, besties. 😤

One token gets generated per call. You can add claims with the -c option. And by default, jwt-generate will add the iat claim, which is Issued At and is the time in seconds since the Unix Epcoch. 🕐 (yes, "Epcoch", we're keeping it, it's iconic 💀)

When you use the --verbose option, jwt-generate will print the JSON HEADER and PAYLOAD to stdout. 👀

And if you pair that with --print, the JSON will be piped to the command's stdin. It will be called twice: once for HEAD and once for PAYLOAD. Two calls. Two moments. Twice the slay. ✨

One use is to pass it through jq -C for indenting and colorization. Another would be to use an external program to inspect the PAYLOAD contents. And heads up: a non-0 exit status from the program will cause generating the token to fail. Like, the whole thing just gives up. 🫠

---

🎀 Options 🎀

• -h, --help — Shows the common options and dips out. Simple. Clean. Iconic. 💅
• -l, --list — Lists every single supported algorithm you could possibly pass to -a, then quits. It's giving ✨menu✨.
• -v, --verbose — Shows the contents of the HEADER and PAYLOAD of the JWT on top of generating the token. NOTE: the header will not show the typ or alg attributes since they do not get added until the final step. They're fashionably late. 🙈
• -q, --quiet — Do not output anything except for hard errors. On success you will only see the token generared. (typo in the original, we preserve it like a museum piece 🏛️)
• -n, --no-iat — Do not add the iat (Issued-At) time to the token. Useful for a slightly smaller token, and for reproducible output. Tiny token, big brain. 🧠
• -a ALG, `--algorithm=ALG — Specify the algorithm to be used when signing the token. Pick your fighter. ⚔️
• *-k *FILE, --key=*FILE*** — Path to a file containing a key in JSON Web Key format. If your keys are in PEM or DER (or some other common format that OpenSSL understands), then you can convert it to a JWK with the key2jwk(1)` tool. Glow-up pipeline fr fr. 🦋
• *-c *CLAIM, --claim=*CLAIM*** — Add a claim to the JWT. The format of *CLAIM* is t:key=valuewheretis the type and is one ofifor integer,sfor string, orbfor boolean. The value for integer must be parseable bystrtol(3). For boolean, any value starting with 0, f, or F` will be interpreted as false. Anything else will be considered true. They key is any ASCII string. 📝
• *-j *JSON, --json=*JSON*** — Use *JSON* string as the payload of the token. This will **not** replace, but be added to the payload. The string must be in valid JSON, meaning either a {}object or a[]` array. No half-baked JSON allowed, bestie. 🚫

---

💀 BUGS 💀

See GitHub Issues: https://github.com/benmcollins/libjwt/issues

(if something's cursed, that's where you go to spill the tea ☕)

---

👑 AUTHOR 👑

jwt-generate was originally written by Jeremy Thien. Major rewriting and man page by Ben Collins bcollins@libjwt.io. Legends, both of them. 🫶

---

🌸 SEE ALSO 🌸

jwt-verify(1), key2jwk(1), jwk2key(1)

(the friend group 💞)

---

And that's a wrap, babe! 🎉 This was the jwt-generate User Manual, page JWT-GENERATE(1), straight from the LibJWT C Library. Stay encoded, stay signed, stay slaying. Byeeeee! 💖✨🎀