jwt-jws-jwe-patterns

name	jwt-jws-jwe-patterns
description	JWT/JWS/JWE token patterns for Swarm Bus agent identity. Sign JWTs with ES256/RS256, verify claims, encrypt payloads with JWE (A256GCM), short-lived token rotation, and agent-to-agent bearer auth. Sources: panva/jose.

/jwt-jws-jwe-patterns

When to Use

• Issue short-lived signed identity tokens for each agent on Swarm Bus
• Verify agent tokens before allowing tool calls through tool-proxy.sh
• Encrypt sensitive claims in JWE (never put secrets in plain JWT payload)
• Token rotation: issue new token every 15 minutes, revoke on session end

Do NOT use for

• Storing large data in tokens (JWT is not a storage mechanism — keep < 2KB)
• Replacing TLS (JWT only authenticates, not encrypts the transport)

---

Sign JWT (ES256 — ECDSA P-256)

import { SignJWT, jwtVerify, generateKeyPair } from 'jose'

// Generate EC key pair (one-time per agent)
const { privateKey, publicKey } = await generateKeyPair('ES256')

// Issue signed token
async function issueAgentToken(agentId: string, tier: 'fast' | 'power'): Promise<string> {
  return new SignJWT({
    :   agentId,
    tier,
    : [, ],
  })
    .({ :  })
    .()
    .()
    .()
    .()          
    .(privateKey)
}


  (): <{ : string; : string }> {
   { payload } =  (token, publicKey, {
    :   ,
    : ,
  })
   { : payload.!, : payload[]  string }
}