ruby-jwt
A ruby implementation of the RFC 7519 OAuth JSON Web Token (JWT) standard.
A Ruby library for creating and verifying JSON Web Tokens (JWTs), supporting HMAC, RSA, and ECDSA signing and automatic validation of expiry, audience, and other standard claims.
This is a Ruby library for creating and verifying JSON Web Tokens, commonly known as JWTs. A JWT is a small, self-contained piece of data used for authentication and authorization in web applications. When a user logs in, a server can issue them a token containing their identity and any permissions. The user's browser or app then sends that token with future requests, and the server can verify it without needing to look up a session in a database.
The library handles both sides of that process: encoding (creating a signed token from a payload) and decoding (reading and verifying a token someone sends back). It supports the main signing methods used in practice, including HMAC with shared secrets, RSA and ECDSA with public and private key pairs, and RSASSA-PSS. A separate companion gem covers the EdDSA algorithm if you need it. You can also plug in your own custom signing logic.
Beyond basic encode and decode, the library supports claim verification, which means it can automatically check that a token is not expired, is being used within its valid time window, is intended for the right audience, and was issued by the expected server. These are standard JWT claims defined in the specification, and the library handles them with options you pass when decoding.
For working with JSON Web Key Sets (the format that public identity providers like Google or Auth0 use to publish their verification keys), the library includes a client that can fetch and cache key sets from a remote URL.
Installation is via RubyGems or Bundler in the usual way. The README includes extensive code examples for each signing algorithm and configuration option.
Where it fits
- Add JWT-based login to a Ruby or Rails API so users authenticate with a signed token instead of a database session.
- Verify tokens from Google or Auth0 by fetching their published JWKS key sets and letting the library handle signature checking.
- Issue access tokens with expiry and audience claims, then decode and validate them on every incoming API request.
- Build a stateless auth flow where the server never stores session data, just signs and later verifies the token.