swarmauri_tokens_rotatingjwt

Rotating JWT token service plugin for Swarmauri.

This package provides a token issuer/verifier that automatically rotates its signing key. It exposes a RotatingJWTTokenService implementing ITokenService and conforms to RFC 7515, 7517, 7518 and 7519.

Features

• Supports RS256, PS256, ES256, EdDSA and HS256 algorithms.
• Automatic key rotation based on time or token count.
• JWKS publication retaining previous key versions.

Installation

uv add swarmauri_tokens_rotatingjwt

Optional extras are available for specific signing canons:

uv add swarmauri_tokens_rotatingjwt[rsa]
uv add swarmauri_tokens_rotatingjwt[ecdsa]
uv add swarmauri_tokens_rotatingjwt[eddsa]
uv add swarmauri_tokens_rotatingjwt[hmac]

Usage

from swarmauri_tokens_rotatingjwt import RotatingJWTTokenService
from swarmauri_keyprovider_inmemory import InMemoryKeyProvider
from swarmauri_core.crypto.types import JWAAlg

kp = InMemoryKeyProvider()
service = RotatingJWTTokenService(kp, alg=JWAAlg.RS256)

token = await service.mint({"sub": "alice"}, alg=JWAAlg.RS256)
claims = await service.verify(token)
jwks = await service.jwks()

The service handles key rotation based on time or token volume and exposes a JWKS endpoint that includes previous keys so existing tokens remain valid.

Want to help?

If you want to contribute to swarmauri-sdk, read up on our guidelines for contributing that will help you get started.