How to verify a JWT with a JWKS in Swift

1// swift-tools-version:6.0
2import PackageDescription
3 
4let package = Package(
5    name: "jwks-demo",
6    platforms: [.macOS(.v13)],
7    dependencies: [
8        .package(url: "https://github.com/vapor/jwt-kit.git", exact: "5.7.1"),
9    ],
10    targets: [
11        .executableTarget(name: "jwks-demo", dependencies: [.product(name: "JWTKit", package: "jwt-kit")]),
12    ]
13)

1import Foundation
2#if canImport(FoundationNetworking)
3import FoundationNetworking // URLSession on Linux
4#endif
5import JWTKit
6 
7struct AccessToken: JWTPayload {
8    var iss: IssuerClaim
9    var sub: SubjectClaim
10    var aud: AudienceClaim
11    var exp: ExpirationClaim
12 
13    // JWTKit checks the signature; the claims are checked here
14    func verify(using algorithm: some JWTAlgorithm) throws {
15        try exp.verifyNotExpired()
16        try aud.verifyIntendedAudience(includes: "api://orders")
17        guard iss.value == "https://issuer.example.com" else {
18            throw JWTError.claimVerificationFailure(failedClaim: iss, reason: "unexpected issuer \(iss.value)")
19        }
20    }
21}
22 
23// Keys from the JWKS, selected by the token's kid (fetch once, cache, refetch on rotation).
24// Each key verifies with its own "alg" from the JWKS, whatever the token header says.
25let jwksURL = URL(string: "https://issuer.example.com/.well-known/jwks.json")!
26let (jwksData, _) = try await URLSession.shared.data(from: jwksURL)
27let keys = try await JWTKeyCollection().add(jwksJSON: String(decoding: jwksData, as: UTF8.self))
28await keys.clearDefault() // otherwise a missing or unknown kid falls back to the first key of the set
29 
30func verifyAccessToken(_ token: String) async throws -> AccessToken {
31    try await keys.verify(token, as: AccessToken.self)
32}

1for line in try String(contentsOfFile: "tokens.txt", encoding: .utf8).split(separator: "\n") {
2    let parts = line.split(separator: " ").map(String.init)
3    do {
4        let claims = try await verifyAccessToken(parts[1])
5        print("\(parts[0]): accepted, sub=\(claims.sub.value)")
6    } catch {
7        print("\(parts[0]): rejected: \(error)")
8    }
9}