Jwt validation with key

[wjdavis5]

Looking at the docs for the jwt Middleware it appears it only supports jwt validation with a secret. Does it also support public key?

[harshagarwalnyu]

Yeah, Hono's jwt middleware supports asymmetric keys (RS256, ES256, PS256, etc.), not just HMAC secrets.

For public key validation, pass the PEM-encoded public key as the secret option and set the alg accordingly:

import { jwt } from 'hono/jwt'

app.use('/protected/*', jwt({
  secret: `-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhki...
-----END PUBLIC KEY-----`,
  alg: 'RS256'
}))

Or with a CryptoKey:

const publicKey = await crypto.subtle.importKey(
  'spki',
  keyBuffer,
  { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-256' },
  true,
  ['verify']
)

app.use('/protected/*', jwt({ secret: publicKey, alg: 'RS256' }))

The alg field tells Hono which algorithm to use for verification.