jsonwebtoken

Sign, verify and decode JWTs (RFC 7519) with a three-function
API. HMAC algorithms only — HS256, HS384 and HS512 — with the
SHA-2, base64url and JSON codecs built in, so nothing else needs
to be installed. Verification pins the algorithm to the caller's
choice (never the token header), compares signatures in constant
time, rejects alg=none, and validates exp/nbf with optional
leeway plus iss/aud/sub on request.