paseto

PASETO (Platform-Agnostic SEcurity TOkens) for Node.js with no dependencies

Authentication / AuthorizationSecurity
panva/pasetopaseto

README

paseto


PASETO: <strong>P</strong>latform-<strong>A</strong>gnostic <strong>SE</strong>curity <strong>TO</strong>kens for Node.js with no dependencies.


Implemented Protocol Versions


|v2v3v4
--------
local✅❌✅
public✅✅✅

Support


If you or your business use paseto, please consider becoming a [sponsor][support-sponsor] so I can continue maintaining it and adding new features carefree.

Documentation


- [API Documentation][documentation]
  - [PASETO Protocol Version v4][documentation-v4]
  - [PASETO Protocol Version v3][documentation-v3]
  - [PASETO Protocol Version v2][documentation-v2]
  - [PASETO Protocol Version v1][documentation-v1]

Usage


Installing paseto

  1. ```console
  2. npm install paseto
  3. ```

Usage
  1. ``` js
  2. const paseto = require('paseto')

  4. // Generic (all versions) APIs
  5. const { decode } = paseto

  7. // PASETO Protocol Version v1 specific API
  8. const { V1 } = paseto // { sign, verify, encrypt, decrypt, generateKey }

  10. // PASETO Protocol Version v2 specific API
  11. const { V2 } = paseto // { sign, verify, generateKey }

  13. // PASETO Protocol Version v3 specific API
  14. const { V3 } = paseto // { sign, verify, encrypt, decrypt, generateKey }

  16. // PASETO Protocol Version v4 specific API
  17. const { V4 } = paseto // { sign, verify, generateKey }

  19. // errors utilized by paseto
  20. const { errors } = paseto
  21. ```

Producing tokens


  1. ``` js
  2. const { V4: { sign } } = paseto

  4. (async () => {
  5.   {
  6.     const token = await sign({ sub: 'johndoe' }, privateKey)
  7.     // v4.public.eyJzdWIiOiJqb2huZG9lIiwiaWF0IjoiMjAyMS0wOC0wM1QwNTozOTozNy42NzNaIn3AW3ri7P5HpdakJmZvhqssz7Wtzi2Rb3JafwKplLoCWuMkITYOo5KNNR5NMaeAR6ePZ3xWUcbO0R11YLb02awO
  8.   }
  9. })()
  10. ```

Consuming tokens


  1. ``` js
  2. const { V4: { verify } } = paseto

  4. (async () => {
  5.   {
  6.     const payload = await verify(token, publicKey)
  7.     // { sub: 'johndoe', iat: '2019-07-01T15:22:47.982Z' }
  8.   }
  9. })()
  10. ```

FAQ


Supported Library Versions


VersionSecurityOtherNewNode.js
----------------------------------------
[3.x.x](https://github.com/panva/paseto)✅✅✅>=
[2.x.x](https://github.com/panva/paseto/tree/v2.x)✅❌❌^12.19.0
[1.x.x](https://github.com/panva/paseto/tree/v1.x)✅❌❌>=

Semver?


Yes. Everything that's either exported in the TypeScript definitions file or
[documented][documentation] is subject to
Semantic Versioning 2.0.0. The rest is to be considered
private API and is subject to change between any versions.

How do I use it outside of Node.js


It is only built for Node.js environment versions >=16.0.0


[documentation]: https://github.com/panva/paseto/blob/main/docs/README.md
[documentation-v4]: https://github.com/panva/paseto/blob/main/docs/README.md#v4-paseto-protocol-version-v4
[documentation-v3]: https://github.com/panva/paseto/blob/main/docs/README.md#v3-paseto-protocol-version-v3
[documentation-v2]: https://github.com/panva/paseto/blob/main/docs/README.md#v2-paseto-protocol-version-v2
[documentation-v1]: https://github.com/panva/paseto/blob/main/docs/README.md#v1-paseto-protocol-version-v1
[support-sponsor]: https://github.com/sponsors/panva