swarmauri_tokens_tlsboundjwt 0.2.0.dev3

mTLS-bound JWT token service for Swarmauri

Swarmauri Tokens TLS-Bound JWT

A mutual-TLS bound JWT token service per RFC 8705. It derives the x5t#S256 confirmation claim from the current client certificate and verifies that presented certificates match the token binding.

Features:

• Automatic cnf claim insertion with the SHA-256 thumbprint of the client certificate
• Verification that rejects tokens when the live certificate is missing or mismatched

Installation

pip install swarmauri_tokens_tlsboundjwt

Usage

from swarmauri_core.crypto.types import JWAAlg
from swarmauri_tokens_tlsboundjwt import TlsBoundJWTTokenService

svc = TlsBoundJWTTokenService(key_provider, client_cert_der_getter=my_cert_getter)
await svc.mint({"sub": "alice"}, alg=JWAAlg.HS256)

Entry Point

The service registers under the swarmauri.tokens entry point as TlsBoundJWTTokenService.