sec-jwt-sign Edge Function — Security

sec-jwt-sign — Sign JWT tokens with HMAC

Creates a signed JSON Web Token (JWT) using HMAC-SHA256 or HMAC-SHA512 via the Web Crypto API — zero npm dependencies.

---

API

POST /api/sec-jwt-sign

Request body

Field	Type	Required	Default	Description
payload	object	✅	—	Claims to embed (e.g. { sub, userId, roles })
secret	string	✅	—	HMAC signing secret
algorithm	"HS256" | "HS512"	❌	"HS256"	HMAC hash algorithm
expiresIn	number	❌	—	Token TTL in seconds — adds exp claim

Success response (200)

{
  "success": true,
  "data": {
    "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyMTIzIiwiaWF0IjoxNzA5MDAwMDAwfQ.abc123"
  }
}

Error responses

Code	HTTP	When
INVALID_INPUT	400	Missing required field or wrong type
INTERNAL_ERROR	500	Unexpected error

---

Usage

cURL

curl -X POST "$FUNCTION_URL" \
  -H "Content-Type: application/json" \
  -d '{"payload": {"sub": "user123", "role": "admin"}, "secret": "my-secret", "expiresIn": 3600}'

TypeScript / JavaScript (HTTP)

const response = await fetch(FUNCTION_URL, {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({
    payload: { sub: 'user123', role: 'admin' },
    secret: 'my-secret',
    algorithm: 'HS256',
    expiresIn: 3600,
  }),
});
const { data } = await response.json();
console.log(data.token);

Direct import (Node / Bun / Deno)

import { jwtSign } from '@aerostack/functions/sec-jwt-sign';

const { token } = await jwtSign({
  payload: { sub: 'user123', role: 'admin' },
  secret: process.env.JWT_SECRET!,
  algorithm: 'HS256',
  expiresIn: 3600,
});

---

Use Cases

• Issuing access tokens after user login in a stateless auth system
• Creating short-lived API tokens for machine-to-machine communication
• Generating signed invite or magic-link tokens with embedded expiry
• Signing webhook payloads so receivers can verify their authenticity

---

Notes

• iat (issued-at) is always added automatically
• exp is only added when expiresIn is provided
• Uses Web Crypto API — works on Cloudflare Workers, Node 18+, Bun, Deno
• Token format is standard JWT: base64url(header).base64url(payload).base64url(signature)
• Use sec-jwt-verify to validate tokens produced by this function