package jwt

Import Path
	github.com/golang-jwt/jwt/v5 (on go.dev)

Dependency Relation
	imports 20 packages, and imported by one package

Involved Source Files

	    claims.go
	  d doc.go
		Package jwt is a Go implementation of JSON Web Tokens: http://self-issued.info/docs/draft-jones-json-web-token.html
		
		See README.md for more info.

	    ecdsa.go
	    ecdsa_utils.go
	    ed25519.go
	    ed25519_utils.go
	    errors.go
	    errors_go1_20.go
	    hmac.go
	    map_claims.go
	    none.go
	    parser.go
	    parser_option.go
	    registered_claims.go
	    rsa.go
	    rsa_pss.go
	    rsa_utils.go
	    signing_method.go
	    token.go
	    token_option.go
	    types.go
	    validator.go
Code Examples

	NewWithClaims_customClaimsType
	  {
	  	mySigningKey := []byte("AllYourBase")
	  
	  	type MyCustomClaims struct {
	  		Foo string `json:"foo"`
	  		jwt.RegisteredClaims
	  	}
	  
	  	claims := MyCustomClaims{
	  		"bar",
	  		jwt.RegisteredClaims{
	  
	  			ExpiresAt: jwt.NewNumericDate(time.Now().Add(24 * time.Hour)),
	  			IssuedAt:  jwt.NewNumericDate(time.Now()),
	  			NotBefore: jwt.NewNumericDate(time.Now()),
	  			Issuer:    "test",
	  			Subject:   "somebody",
	  			ID:        "1",
	  			Audience:  []string{"somebody_else"},
	  		},
	  	}
	  
	  	fmt.Printf("foo: %v\n", claims.Foo)
	  
	  	claims = MyCustomClaims{
	  		"bar",
	  		jwt.RegisteredClaims{
	  
	  			ExpiresAt: jwt.NewNumericDate(time.Unix(1516239022, 0)),
	  			Issuer:    "test",
	  		},
	  	}
	  
	  	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
	  	ss, err := token.SignedString(mySigningKey)
	  	fmt.Println(ss, err)
	  
	  }
	NewWithClaims_registeredClaims
	  {
	  	mySigningKey := []byte("AllYourBase")
	  
	  	claims := &jwt.RegisteredClaims{
	  		ExpiresAt: jwt.NewNumericDate(time.Unix(1516239022, 0)),
	  		Issuer:    "test",
	  	}
	  
	  	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
	  	ss, err := token.SignedString(mySigningKey)
	  	fmt.Println(ss, err)
	  
	  }
	ParseWithClaims_customClaimsType
	  {
	  	tokenString := "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJmb28iOiJiYXIiLCJpc3MiOiJ0ZXN0IiwiYXVkIjoic2luZ2xlIn0.QAWg1vGvnqRuCFTMcPkjZljXHh8U3L_qUjszOtQbeaA"
	  
	  	type MyCustomClaims struct {
	  		Foo string `json:"foo"`
	  		jwt.RegisteredClaims
	  	}
	  
	  	token, err := jwt.ParseWithClaims(tokenString, &MyCustomClaims{}, func(token *jwt.Token) (interface{}, error) {
	  		return []byte("AllYourBase"), nil
	  	})
	  	if err != nil {
	  		log.Fatal(err)
	  	} else if claims, ok := token.Claims.(*MyCustomClaims); ok {
	  		fmt.Println(claims.Foo, claims.RegisteredClaims.Issuer)
	  	} else {
	  		log.Fatal("unknown claims type, cannot proceed")
	  	}
	  
	  }
	ParseWithClaims_customValidation
	  {
	  	tokenString := "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJmb28iOiJiYXIiLCJpc3MiOiJ0ZXN0IiwiYXVkIjoic2luZ2xlIn0.QAWg1vGvnqRuCFTMcPkjZljXHh8U3L_qUjszOtQbeaA"
	  
	  	token, err := jwt.ParseWithClaims(tokenString, &MyCustomClaims{}, func(token *jwt.Token) (interface{}, error) {
	  		return []byte("AllYourBase"), nil
	  	}, jwt.WithLeeway(5*time.Second))
	  	if err != nil {
	  		log.Fatal(err)
	  	} else if claims, ok := token.Claims.(*MyCustomClaims); ok {
	  		fmt.Println(claims.Foo, claims.RegisteredClaims.Issuer)
	  	} else {
	  		log.Fatal("unknown claims type, cannot proceed")
	  	}
	  
	  }
	ParseWithClaims_validationOptions
	  {
	  	tokenString := "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJmb28iOiJiYXIiLCJpc3MiOiJ0ZXN0IiwiYXVkIjoic2luZ2xlIn0.QAWg1vGvnqRuCFTMcPkjZljXHh8U3L_qUjszOtQbeaA"
	  
	  	type MyCustomClaims struct {
	  		Foo string `json:"foo"`
	  		jwt.RegisteredClaims
	  	}
	  
	  	token, err := jwt.ParseWithClaims(tokenString, &MyCustomClaims{}, func(token *jwt.Token) (interface{}, error) {
	  		return []byte("AllYourBase"), nil
	  	}, jwt.WithLeeway(5*time.Second))
	  	if err != nil {
	  		log.Fatal(err)
	  	} else if claims, ok := token.Claims.(*MyCustomClaims); ok {
	  		fmt.Println(claims.Foo, claims.RegisteredClaims.Issuer)
	  	} else {
	  		log.Fatal("unknown claims type, cannot proceed")
	  	}
	  
	  }
	Parse_errorChecking
	  {
	  	// Token from another example.  This token is expired
	  	var tokenString = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJmb28iOiJiYXIiLCJleHAiOjE1MDAwLCJpc3MiOiJ0ZXN0In0.HE7fK0xOQwFEr4WDgRWj4teRPZ6i3GLwD5YCm6Pwu_c"
	  
	  	token, err := jwt.Parse(tokenString, func(token *jwt.Token) (interface{}, error) {
	  		return []byte("AllYourBase"), nil
	  	})
	  
	  	switch {
	  	case token.Valid:
	  		fmt.Println("You look nice today")
	  	case errors.Is(err, jwt.ErrTokenMalformed):
	  		fmt.Println("That's not even a token")
	  	case errors.Is(err, jwt.ErrTokenSignatureInvalid):
	  
	  		fmt.Println("Invalid signature")
	  	case errors.Is(err, jwt.ErrTokenExpired) || errors.Is(err, jwt.ErrTokenNotValidYet):
	  
	  		fmt.Println("Timing is everything")
	  	default:
	  		fmt.Println("Couldn't handle this token:", err)
	  	}
	  
	  }

Package-Level Type Names (total 23, in which 20 are exported)

	/* sort exporteds by: alphabet | popularity */
	 type Claims (interface)
		Claims represent any form of a JWT Claims Set according to
		https://datatracker.ietf.org/doc/html/rfc7519#section-4. In order to have a
		common basis for validation, it is required that an implementation is able to
		supply at least the claim names provided in
		https://datatracker.ietf.org/doc/html/rfc7519#section-4.1 namely `exp`,
		`iat`, `nbf`, `iss`, `sub` and `aud`.

		Methods (total 6, all are exported)
			( Claims) GetAudience() (ClaimStrings, error)
			( Claims) GetExpirationTime() (*NumericDate, error)
			( Claims) GetIssuedAt() (*NumericDate, error)
			( Claims) GetIssuer() (string, error)
			( Claims) GetNotBefore() (*NumericDate, error)
			( Claims) GetSubject() (string, error)
		Implemented By (at least 4, all are exported)
			 ClaimsValidator (interface)
			 MapClaims
			 RegisteredClaims
			 github.com/coinbase/cdp-sdk/go/auth.WalletAuthClaims
		As Inputs Of (at least 11, in which 5 are exported)
			func NewWithClaims(method SigningMethod, claims Claims, opts ...TokenOption) *Token
			func ParseWithClaims(tokenString string, claims Claims, keyFunc Keyfunc, options ...ParserOption) (*Token, error)
			func (*Parser).ParseUnverified(tokenString string, claims Claims) (token *Token, parts []string, err error)
			func (*Parser).ParseWithClaims(tokenString string, claims Claims, keyFunc Keyfunc) (*Token, error)
			func (*Validator).Validate(claims Claims) error
			/* 6+ unexporteds ... *//* 6+ unexporteds: */
			func (*Validator).verifyAudience(claims Claims, cmp string, required bool) error
			func (*Validator).verifyExpiresAt(claims Claims, cmp time.Time, required bool) error
			func (*Validator).verifyIssuedAt(claims Claims, cmp time.Time, required bool) error
			func (*Validator).verifyIssuer(claims Claims, cmp string, required bool) error
			func (*Validator).verifyNotBefore(claims Claims, cmp time.Time, required bool) error
			func (*Validator).verifySubject(claims Claims, cmp string, required bool) error

	 type ClaimStrings ([])
		ClaimStrings is basically just a slice of strings, but it can be either
		serialized from a string array or just a string. This type is necessary,
		since the "aud" claim can either be a single string or an array.

		Methods (total 2, both are exported)
			( ClaimStrings) MarshalJSON() (b []byte, err error)
			(*ClaimStrings) UnmarshalJSON(data []byte) (err error)
		Implements (at least 2, both are exported)
			 ClaimStrings : encoding/json.Marshaler
			*ClaimStrings : encoding/json.Unmarshaler
		As Outputs Of (at least 5, in which 4 are exported)
			func Claims.GetAudience() (ClaimStrings, error)
			func ClaimsValidator.GetAudience() (ClaimStrings, error)
			func MapClaims.GetAudience() (ClaimStrings, error)
			func RegisteredClaims.GetAudience() (ClaimStrings, error)
			/* at least one unexported ... *//* at least one unexported: */
			func MapClaims.parseClaimsString(key string) (ClaimStrings, error)

	 type ClaimsValidator (interface)
		ClaimsValidator is an interface that can be implemented by custom claims who
		wish to execute any additional claims validation based on
		application-specific logic. The Validate function is then executed in
		addition to the regular claims validation and any error returned is appended
		to the final validation result.
		
			type MyCustomClaims struct {
			    Foo string `json:"foo"`
			    jwt.RegisteredClaims
			}
		
			func (m MyCustomClaims) Validate() error {
			    if m.Foo != "bar" {
			        return errors.New("must be foobar")
			    }
			    return nil
			}

		Methods (total 7, all are exported)
			( ClaimsValidator) GetAudience() (ClaimStrings, error)
			( ClaimsValidator) GetExpirationTime() (*NumericDate, error)
			( ClaimsValidator) GetIssuedAt() (*NumericDate, error)
			( ClaimsValidator) GetIssuer() (string, error)
			( ClaimsValidator) GetNotBefore() (*NumericDate, error)
			( ClaimsValidator) GetSubject() (string, error)
			( ClaimsValidator) Validate() error
		Implements (at least one exported)
			 ClaimsValidator : Claims

	 type Keyfunc (func)
		Keyfunc will be used by the Parse methods as a callback function to supply
		the key for verification.  The function receives the parsed, but unverified
		Token.  This allows you to use properties in the Header of the token (such as
		`kid`) to identify which key to use.
		
		The returned interface{} may be a single key or a VerificationKeySet containing
		multiple keys.

		As Inputs Of (at least 4, all are exported)
			func Parse(tokenString string, keyFunc Keyfunc, options ...ParserOption) (*Token, error)
			func ParseWithClaims(tokenString string, claims Claims, keyFunc Keyfunc, options ...ParserOption) (*Token, error)
			func (*Parser).Parse(tokenString string, keyFunc Keyfunc) (*Token, error)
			func (*Parser).ParseWithClaims(tokenString string, claims Claims, keyFunc Keyfunc) (*Token, error)

	 type MapClaims (map)
		MapClaims is a claims type that uses the map[string]interface{} for JSON
		decoding. This is the default claims type if you don't supply one

		Methods (total 9, in which 6 are exported)
			( MapClaims) GetAudience() (ClaimStrings, error)
				GetAudience implements the Claims interface.

			( MapClaims) GetExpirationTime() (*NumericDate, error)
				GetExpirationTime implements the Claims interface.

			( MapClaims) GetIssuedAt() (*NumericDate, error)
				GetIssuedAt implements the Claims interface.

			( MapClaims) GetIssuer() (string, error)
				GetIssuer implements the Claims interface.

			( MapClaims) GetNotBefore() (*NumericDate, error)
				GetNotBefore implements the Claims interface.

			( MapClaims) GetSubject() (string, error)
				GetSubject implements the Claims interface.

			/* 3 unexporteds ... *//* 3 unexporteds: */
			( MapClaims) parseClaimsString(key string) (ClaimStrings, error)
				parseClaimsString tries to parse a key in the map claims type as a
				[ClaimsStrings] type, which can either be a string or an array of string.

			( MapClaims) parseNumericDate(key string) (*NumericDate, error)
				parseNumericDate tries to parse a key in the map claims type as a number
				date. This will succeed, if the underlying type is either a [float64] or a
				[json.Number]. Otherwise, nil will be returned.

			( MapClaims) parseString(key string) (string, error)
				parseString tries to parse a key in the map claims type as a [string] type.
				If the key does not exist, an empty string is returned. If the key has the
				wrong type, an error is returned.

		Implements (at least one exported)
			 MapClaims : Claims

	 type NumericDate (struct)
		NumericDate represents a JSON numeric date value, as referenced at
		https://datatracker.ietf.org/doc/html/rfc7519#section-2.

		Fields (total 4, in which 1 is exported)
			Time time.Time
			/* 3 unexporteds ... *//* 3 unexporteds: */
			Time.ext int64
			Time.loc *time.Location
				loc specifies the Location that should be used to
				determine the minute, hour, month, day, and year
				that correspond to this Time.
				The nil location means UTC.
				All UTC times are represented with loc==nil, never loc==&utcLoc.

			Time.wall uint64
				wall and ext encode the wall time seconds, wall time nanoseconds,
				and optional monotonic clock reading in nanoseconds.
				
				From high to low bit position, wall encodes a 1-bit flag (hasMonotonic),
				a 33-bit seconds field, and a 30-bit wall time nanoseconds field.
				The nanoseconds field is in the range [0, 999999999].
				If the hasMonotonic bit is 0, then the 33-bit field must be zero
				and the full signed 64-bit wall seconds since Jan 1 year 1 is stored in ext.
				If the hasMonotonic bit is 1, then the 33-bit field holds a 33-bit
				unsigned wall seconds since Jan 1 year 1885, and ext holds a
				signed 64-bit monotonic clock reading, nanoseconds since process start.

		Methods (total 59, in which 45 are exported)
			( NumericDate) Add(d time.Duration) time.Time
				Add returns the time t+d.

			( NumericDate) AddDate(years int, months int, days int) time.Time
				AddDate returns the time corresponding to adding the
				given number of years, months, and days to t.
				For example, AddDate(-1, 2, 3) applied to January 1, 2011
				returns March 4, 2010.
				
				Note that dates are fundamentally coupled to timezones, and calendrical
				periods like days don't have fixed durations. AddDate uses the Location of
				the Time value to determine these durations. That means that the same
				AddDate arguments can produce a different shift in absolute time depending on
				the base Time value and its Location. For example, AddDate(0, 0, 1) applied
				to 12:00 on March 27 always returns 12:00 on March 28. At some locations and
				in some years this is a 24 hour shift. In others it's a 23 hour shift due to
				daylight savings time transitions.
				
				AddDate normalizes its result in the same way that Date does,
				so, for example, adding one month to October 31 yields
				December 1, the normalized form for November 31.

			( NumericDate) After(u time.Time) bool
				After reports whether the time instant t is after u.

			( NumericDate) AppendFormat(b []byte, layout string) []byte
				AppendFormat is like [Time.Format] but appends the textual
				representation to b and returns the extended buffer.

			( NumericDate) Before(u time.Time) bool
				Before reports whether the time instant t is before u.

			( NumericDate) Clock() (hour, min, sec int)
				Clock returns the hour, minute, and second within the day specified by t.

			( NumericDate) Compare(u time.Time) int
				Compare compares the time instant t with u. If t is before u, it returns -1;
				if t is after u, it returns +1; if they're the same, it returns 0.

			( NumericDate) Date() (year int, month time.Month, day int)
				Date returns the year, month, and day in which t occurs.

			( NumericDate) Day() int
				Day returns the day of the month specified by t.

			( NumericDate) Equal(u time.Time) bool
				Equal reports whether t and u represent the same time instant.
				Two times can be equal even if they are in different locations.
				For example, 6:00 +0200 and 4:00 UTC are Equal.
				See the documentation on the Time type for the pitfalls of using == with
				Time values; most code should use Equal instead.

			( NumericDate) Format(layout string) string
				Format returns a textual representation of the time value formatted according
				to the layout defined by the argument. See the documentation for the
				constant called [Layout] to see how to represent the layout format.
				
				The executable example for [Time.Format] demonstrates the working
				of the layout string in detail and is a good reference.

			( NumericDate) GoString() string
				GoString implements [fmt.GoStringer] and formats t to be printed in Go source
				code.

			(*NumericDate) GobDecode(data []byte) error
				GobDecode implements the gob.GobDecoder interface.

			( NumericDate) GobEncode() ([]byte, error)
				GobEncode implements the gob.GobEncoder interface.

			( NumericDate) Hour() int
				Hour returns the hour within the day specified by t, in the range [0, 23].

			( NumericDate) ISOWeek() (year, week int)
				ISOWeek returns the ISO 8601 year and week number in which t occurs.
				Week ranges from 1 to 53. Jan 01 to Jan 03 of year n might belong to
				week 52 or 53 of year n-1, and Dec 29 to Dec 31 might belong to week 1
				of year n+1.

			( NumericDate) In(loc *time.Location) time.Time
				In returns a copy of t representing the same time instant, but
				with the copy's location information set to loc for display
				purposes.
				
				In panics if loc is nil.

			( NumericDate) IsDST() bool
				IsDST reports whether the time in the configured location is in Daylight Savings Time.

			( NumericDate) IsZero() bool
				IsZero reports whether t represents the zero time instant,
				January 1, year 1, 00:00:00 UTC.

			( NumericDate) Local() time.Time
				Local returns t with the location set to local time.

			( NumericDate) Location() *time.Location
				Location returns the time zone information associated with t.

			( NumericDate) MarshalBinary() ([]byte, error)
				MarshalBinary implements the encoding.BinaryMarshaler interface.

			( NumericDate) MarshalJSON() (b []byte, err error)
				MarshalJSON is an implementation of the json.RawMessage interface and serializes the UNIX epoch
				represented in NumericDate to a byte array, using the precision specified in TimePrecision.

			( NumericDate) MarshalText() ([]byte, error)
				MarshalText implements the [encoding.TextMarshaler] interface.
				The time is formatted in RFC 3339 format with sub-second precision.
				If the timestamp cannot be represented as valid RFC 3339
				(e.g., the year is out of range), then an error is reported.

			( NumericDate) Minute() int
				Minute returns the minute offset within the hour specified by t, in the range [0, 59].

			( NumericDate) Month() time.Month
				Month returns the month of the year specified by t.

			( NumericDate) Nanosecond() int
				Nanosecond returns the nanosecond offset within the second specified by t,
				in the range [0, 999999999].

			( NumericDate) Round(d time.Duration) time.Time
				Round returns the result of rounding t to the nearest multiple of d (since the zero time).
				The rounding behavior for halfway values is to round up.
				If d <= 0, Round returns t stripped of any monotonic clock reading but otherwise unchanged.
				
				Round operates on the time as an absolute duration since the
				zero time; it does not operate on the presentation form of the
				time. Thus, Round(Hour) may return a time with a non-zero
				minute, depending on the time's Location.

			( NumericDate) Second() int
				Second returns the second offset within the minute specified by t, in the range [0, 59].

			( NumericDate) String() string
				String returns the time formatted using the format string
				
					"2006-01-02 15:04:05.999999999 -0700 MST"
				
				If the time has a monotonic clock reading, the returned string
				includes a final field "m=±<value>", where value is the monotonic
				clock reading formatted as a decimal number of seconds.
				
				The returned string is meant for debugging; for a stable serialized
				representation, use t.MarshalText, t.MarshalBinary, or t.Format
				with an explicit format string.

			( NumericDate) Sub(u time.Time) time.Duration
				Sub returns the duration t-u. If the result exceeds the maximum (or minimum)
				value that can be stored in a [Duration], the maximum (or minimum) duration
				will be returned.
				To compute t-d for a duration d, use t.Add(-d).

			( NumericDate) Truncate(d time.Duration) time.Time
				Truncate returns the result of rounding t down to a multiple of d (since the zero time).
				If d <= 0, Truncate returns t stripped of any monotonic clock reading but otherwise unchanged.
				
				Truncate operates on the time as an absolute duration since the
				zero time; it does not operate on the presentation form of the
				time. Thus, Truncate(Hour) may return a time with a non-zero
				minute, depending on the time's Location.

			( NumericDate) UTC() time.Time
				UTC returns t with the location set to UTC.

			( NumericDate) Unix() int64
				Unix returns t as a Unix time, the number of seconds elapsed
				since January 1, 1970 UTC. The result does not depend on the
				location associated with t.
				Unix-like operating systems often record time as a 32-bit
				count of seconds, but since the method here returns a 64-bit
				value it is valid for billions of years into the past or future.

			( NumericDate) UnixMicro() int64
				UnixMicro returns t as a Unix time, the number of microseconds elapsed since
				January 1, 1970 UTC. The result is undefined if the Unix time in
				microseconds cannot be represented by an int64 (a date before year -290307 or
				after year 294246). The result does not depend on the location associated
				with t.

			( NumericDate) UnixMilli() int64
				UnixMilli returns t as a Unix time, the number of milliseconds elapsed since
				January 1, 1970 UTC. The result is undefined if the Unix time in
				milliseconds cannot be represented by an int64 (a date more than 292 million
				years before or after 1970). The result does not depend on the
				location associated with t.

			( NumericDate) UnixNano() int64
				UnixNano returns t as a Unix time, the number of nanoseconds elapsed
				since January 1, 1970 UTC. The result is undefined if the Unix time
				in nanoseconds cannot be represented by an int64 (a date before the year
				1678 or after 2262). Note that this means the result of calling UnixNano
				on the zero Time is undefined. The result does not depend on the
				location associated with t.

			(*NumericDate) UnmarshalBinary(data []byte) error
				UnmarshalBinary implements the encoding.BinaryUnmarshaler interface.

			(*NumericDate) UnmarshalJSON(b []byte) (err error)
				UnmarshalJSON is an implementation of the json.RawMessage interface and
				deserializes a [NumericDate] from a JSON representation, i.e. a
				[json.Number]. This number represents an UNIX epoch with either integer or
				non-integer seconds.

			(*NumericDate) UnmarshalText(data []byte) error
				UnmarshalText implements the [encoding.TextUnmarshaler] interface.
				The time must be in the RFC 3339 format.

			( NumericDate) Weekday() time.Weekday
				Weekday returns the day of the week specified by t.

			( NumericDate) Year() int
				Year returns the year in which t occurs.

			( NumericDate) YearDay() int
				YearDay returns the day of the year specified by t, in the range [1,365] for non-leap years,
				and [1,366] in leap years.

			( NumericDate) Zone() (name string, offset int)
				Zone computes the time zone in effect at time t, returning the abbreviated
				name of the zone (such as "CET") and its offset in seconds east of UTC.

			( NumericDate) ZoneBounds() (start, end time.Time)
				ZoneBounds returns the bounds of the time zone in effect at time t.
				The zone begins at start and the next zone begins at end.
				If the zone begins at the beginning of time, start will be returned as a zero Time.
				If the zone goes on forever, end will be returned as a zero Time.
				The Location of the returned times will be the same as t.

			/* 14 unexporteds ... *//* 14 unexporteds: */
			( NumericDate) abs() uint64
				abs returns the time t as an absolute time, adjusted by the zone offset.
				It is called when computing a presentation property like Month or Hour.

			(*NumericDate) addSec(d int64)
				addSec adds d seconds to the time.

			( NumericDate) appendFormat(b []byte, layout string) []byte
			( NumericDate) appendFormatRFC3339(b []byte, nanos bool) []byte
			( NumericDate) appendStrictRFC3339(b []byte) ([]byte, error)
			( NumericDate) date(full bool) (year int, month time.Month, day int, yday int)
				date computes the year, day of year, and when full=true,
				the month and day in which t occurs.

			( NumericDate) locabs() (name string, offset int, abs uint64)
				locabs is a combination of the Zone and abs methods,
				extracting both return values from a single zone lookup.

			(*NumericDate) mono() int64
				mono returns t's monotonic clock reading.
				It returns 0 for a missing reading.
				This function is used only for testing,
				so it's OK that technically 0 is a valid
				monotonic clock reading as well.

			(*NumericDate) nsec() int32
				nsec returns the time's nanoseconds.

			(*NumericDate) sec() int64
				sec returns the time's seconds since Jan 1 year 1.

			(*NumericDate) setLoc(loc *time.Location)
				setLoc sets the location associated with the time.

			(*NumericDate) setMono(m int64)
				setMono sets the monotonic clock reading in t.
				If t cannot hold a monotonic clock reading,
				because its wall time is too large,
				setMono is a no-op.

			(*NumericDate) stripMono()
				stripMono strips the monotonic clock reading in t.

			(*NumericDate) unixSec() int64
				unixSec returns the time's seconds since Jan 1 1970 (Unix time).

		Implements (at least 11, in which 8 are exported)
			 NumericDate : encoding.BinaryMarshaler
			*NumericDate : encoding.BinaryUnmarshaler
			 NumericDate : encoding.TextMarshaler
			*NumericDate : encoding.TextUnmarshaler
			 NumericDate : encoding/json.Marshaler
			*NumericDate : encoding/json.Unmarshaler
			 NumericDate : fmt.GoStringer
			 NumericDate : fmt.Stringer
			/* 3+ unexporteds ... *//* 3+ unexporteds: */
			 NumericDate : context.stringer
			*NumericDate : crypto/hmac.marshalable
			 NumericDate : runtime.stringer
		As Outputs Of (at least 15, in which 13 are exported)
			func NewNumericDate(t time.Time) *NumericDate
			func Claims.GetExpirationTime() (*NumericDate, error)
			func Claims.GetIssuedAt() (*NumericDate, error)
			func Claims.GetNotBefore() (*NumericDate, error)
			func ClaimsValidator.GetExpirationTime() (*NumericDate, error)
			func ClaimsValidator.GetIssuedAt() (*NumericDate, error)
			func ClaimsValidator.GetNotBefore() (*NumericDate, error)
			func MapClaims.GetExpirationTime() (*NumericDate, error)
			func MapClaims.GetIssuedAt() (*NumericDate, error)
			func MapClaims.GetNotBefore() (*NumericDate, error)
			func RegisteredClaims.GetExpirationTime() (*NumericDate, error)
			func RegisteredClaims.GetIssuedAt() (*NumericDate, error)
			func RegisteredClaims.GetNotBefore() (*NumericDate, error)
			/* 2+ unexporteds ... *//* 2+ unexporteds: */
			func newNumericDateFromSeconds(f float64) *NumericDate
			func MapClaims.parseNumericDate(key string) (*NumericDate, error)

	 type Parser (struct)

		Fields (total 6, none are exported)
			/* 6 unexporteds ... *//* 6 unexporteds: */
			decodePaddingAllowed bool
			decodeStrict bool
			skipClaimsValidation bool
				Skip claims validation during token parsing.

			useJSONNumber bool
				Use JSON Number format in JSON decoder.

			validMethods []string
				If populated, only these methods will be considered valid.

			validator *Validator
		Methods (total 4, all are exported)
			(*Parser) DecodeSegment(seg string) ([]byte, error)
				DecodeSegment decodes a JWT specific base64url encoding. This function will
				take into account whether the [Parser] is configured with additional options,
				such as [WithStrictDecoding] or [WithPaddingAllowed].

			(*Parser) Parse(tokenString string, keyFunc Keyfunc) (*Token, error)
				Parse parses, validates, verifies the signature and returns the parsed token.
				keyFunc will receive the parsed token and should return the key for validating.

			(*Parser) ParseUnverified(tokenString string, claims Claims) (token *Token, parts []string, err error)
				ParseUnverified parses the token but doesn't validate the signature.
				
				WARNING: Don't use this method unless you know what you're doing.
				
				It's only ever useful in cases where you know the signature is valid (since it has already
				been or will be checked elsewhere in the stack) and you want to extract values from it.

			(*Parser) ParseWithClaims(tokenString string, claims Claims, keyFunc Keyfunc) (*Token, error)
				ParseWithClaims parses, validates, and verifies like Parse, but supplies a default object implementing the Claims
				interface. This provides default values which can be overridden and allows a caller to use their own type, rather
				than the default MapClaims implementation of Claims.
				
				Note: If you provide a custom claim implementation that embeds one of the standard claims (such as RegisteredClaims),
				make sure that a) you either embed a non-pointer version of the claims or b) if you are using a pointer, allocate the
				proper memory for it before passing in the overall claims, otherwise you might run into a panic.

		As Outputs Of (at least one exported)
			func NewParser(options ...ParserOption) *Parser

	 type ParserOption (func)
		ParserOption is used to implement functional-style options that modify the
		behavior of the parser. To add new options, just create a function (ideally
		beginning with With or Without) that returns an anonymous function that takes
		a *Parser type as input and manipulates its configuration accordingly.

		As Outputs Of (at least 12, all are exported)
			func WithAudience(aud string) ParserOption
			func WithExpirationRequired() ParserOption
			func WithIssuedAt() ParserOption
			func WithIssuer(iss string) ParserOption
			func WithJSONNumber() ParserOption
			func WithLeeway(leeway time.Duration) ParserOption
			func WithoutClaimsValidation() ParserOption
			func WithPaddingAllowed() ParserOption
			func WithStrictDecoding() ParserOption
			func WithSubject(sub string) ParserOption
			func WithTimeFunc(f func() time.Time) ParserOption
			func WithValidMethods(methods []string) ParserOption
		As Inputs Of (at least 4, all are exported)
			func NewParser(options ...ParserOption) *Parser
			func NewValidator(opts ...ParserOption) *Validator
			func Parse(tokenString string, keyFunc Keyfunc, options ...ParserOption) (*Token, error)
			func ParseWithClaims(tokenString string, claims Claims, keyFunc Keyfunc, options ...ParserOption) (*Token, error)

	 type RegisteredClaims (struct)
		RegisteredClaims are a structured version of the JWT Claims Set,
		restricted to Registered Claim Names, as referenced at
		https://datatracker.ietf.org/doc/html/rfc7519#section-4.1
		
		This type can be used on its own, but then additional private and
		public claims embedded in the JWT will not be parsed. The typical use-case
		therefore is to embedded this in a user-defined claim type.
		
		See examples for how to use this with your own claim types.

		Fields (total 7, all are exported)
			Audience ClaimStrings
				the `aud` (Audience) claim. See https://datatracker.ietf.org/doc/html/rfc7519#section-4.1.3

			ExpiresAt *NumericDate
				the `exp` (Expiration Time) claim. See https://datatracker.ietf.org/doc/html/rfc7519#section-4.1.4

			ID string
				the `jti` (JWT ID) claim. See https://datatracker.ietf.org/doc/html/rfc7519#section-4.1.7

			IssuedAt *NumericDate
				the `iat` (Issued At) claim. See https://datatracker.ietf.org/doc/html/rfc7519#section-4.1.6

			Issuer string
				the `iss` (Issuer) claim. See https://datatracker.ietf.org/doc/html/rfc7519#section-4.1.1

			NotBefore *NumericDate
				the `nbf` (Not Before) claim. See https://datatracker.ietf.org/doc/html/rfc7519#section-4.1.5

			Subject string
				the `sub` (Subject) claim. See https://datatracker.ietf.org/doc/html/rfc7519#section-4.1.2

		Methods (total 6, all are exported)
			( RegisteredClaims) GetAudience() (ClaimStrings, error)
				GetAudience implements the Claims interface.

			( RegisteredClaims) GetExpirationTime() (*NumericDate, error)
				GetExpirationTime implements the Claims interface.

			( RegisteredClaims) GetIssuedAt() (*NumericDate, error)
				GetIssuedAt implements the Claims interface.

			( RegisteredClaims) GetIssuer() (string, error)
				GetIssuer implements the Claims interface.

			( RegisteredClaims) GetNotBefore() (*NumericDate, error)
				GetNotBefore implements the Claims interface.

			( RegisteredClaims) GetSubject() (string, error)
				GetSubject implements the Claims interface.

		Implements (at least one exported)
			 RegisteredClaims : Claims

	 type SigningMethod (interface)
		SigningMethod can be used add new methods for signing or verifying tokens. It
		takes a decoded signature as an input in the Verify function and produces a
		signature in Sign. The signature is then usually base64 encoded as part of a
		JWT.

		Methods (total 3, all are exported)
			( SigningMethod) Alg() string
				// returns the alg identifier for this method (example: 'HS256')

			( SigningMethod) Sign(signingString string, key interface{}) ([]byte, error)
				// Returns signature or error

			( SigningMethod) Verify(signingString string, sig []byte, key interface{}) error
				// Returns nil if signature is valid

		Implemented By (at least 6, in which 5 are exported)
			*SigningMethodECDSA
			*SigningMethodEd25519
			*SigningMethodHMAC
			*SigningMethodRSA
			*SigningMethodRSAPSS
			/* at least one unexported ... *//* at least one unexported: */
			*signingMethodNone
		As Outputs Of (at least one exported)
			func GetSigningMethod(alg string) (method SigningMethod)
		As Inputs Of (at least 2, both are exported)
			func New(method SigningMethod, opts ...TokenOption) *Token
			func NewWithClaims(method SigningMethod, claims Claims, opts ...TokenOption) *Token

	 type SigningMethodECDSA (struct)
		SigningMethodECDSA implements the ECDSA family of signing methods.
		Expects *ecdsa.PrivateKey for signing and *ecdsa.PublicKey for verification

		Fields (total 4, all are exported)
			CurveBits int
			Hash crypto.Hash
			KeySize int
			Name string
		Methods (total 3, all are exported)
			(*SigningMethodECDSA) Alg() string
			(*SigningMethodECDSA) Sign(signingString string, key interface{}) ([]byte, error)
				Sign implements token signing for the SigningMethod.
				For this signing method, key must be an ecdsa.PrivateKey struct

			(*SigningMethodECDSA) Verify(signingString string, sig []byte, key interface{}) error
				Verify implements token verification for the SigningMethod.
				For this verify method, key must be an ecdsa.PublicKey struct

		Implements (at least one exported)
			*SigningMethodECDSA : SigningMethod
		As Types Of (total 3, all are exported)
			  var SigningMethodES256 *SigningMethodECDSA
			  var SigningMethodES384 *SigningMethodECDSA
			  var SigningMethodES512 *SigningMethodECDSA

	 type SigningMethodEd25519 (struct)
		SigningMethodEd25519 implements the EdDSA family.
		Expects ed25519.PrivateKey for signing and ed25519.PublicKey for verification

		Methods (total 3, all are exported)
			(*SigningMethodEd25519) Alg() string
			(*SigningMethodEd25519) Sign(signingString string, key interface{}) ([]byte, error)
				Sign implements token signing for the SigningMethod.
				For this signing method, key must be an ed25519.PrivateKey

			(*SigningMethodEd25519) Verify(signingString string, sig []byte, key interface{}) error
				Verify implements token verification for the SigningMethod.
				For this verify method, key must be an ed25519.PublicKey

		Implements (at least one exported)
			*SigningMethodEd25519 : SigningMethod
		As Types Of (only one, which is exported)
			  var SigningMethodEdDSA *SigningMethodEd25519

	 type SigningMethodHMAC (struct)
		SigningMethodHMAC implements the HMAC-SHA family of signing methods.
		Expects key type of []byte for both signing and validation

		Fields (total 2, both are exported)
			Hash crypto.Hash
			Name string
		Methods (total 3, all are exported)
			(*SigningMethodHMAC) Alg() string
			(*SigningMethodHMAC) Sign(signingString string, key interface{}) ([]byte, error)
				Sign implements token signing for the SigningMethod. Key must be []byte.
				
				Note it is not advised to provide a []byte which was converted from a 'human
				readable' string using a subset of ASCII characters. To maximize entropy, you
				should ideally be providing a []byte key which was produced from a
				cryptographically random source, e.g. crypto/rand. Additional information
				about this, and why we intentionally are not supporting string as a key can
				be found on our usage guide https://golang-jwt.github.io/jwt/usage/signing_methods/.

			(*SigningMethodHMAC) Verify(signingString string, sig []byte, key interface{}) error
				Verify implements token verification for the SigningMethod. Returns nil if
				the signature is valid. Key must be []byte.
				
				Note it is not advised to provide a []byte which was converted from a 'human
				readable' string using a subset of ASCII characters. To maximize entropy, you
				should ideally be providing a []byte key which was produced from a
				cryptographically random source, e.g. crypto/rand. Additional information
				about this, and why we intentionally are not supporting string as a key can
				be found on our usage guide
				https://golang-jwt.github.io/jwt/usage/signing_methods/#signing-methods-and-key-types.

		Implements (at least one exported)
			*SigningMethodHMAC : SigningMethod
		As Types Of (total 3, all are exported)
			  var SigningMethodHS256 *SigningMethodHMAC
			  var SigningMethodHS384 *SigningMethodHMAC
			  var SigningMethodHS512 *SigningMethodHMAC

	 type SigningMethodRSA (struct)
		SigningMethodRSA implements the RSA family of signing methods.
		Expects *rsa.PrivateKey for signing and *rsa.PublicKey for validation

		Fields (total 2, both are exported)
			Hash crypto.Hash
			Name string
		Methods (total 3, all are exported)
			(*SigningMethodRSA) Alg() string
			(*SigningMethodRSA) Sign(signingString string, key interface{}) ([]byte, error)
				Sign implements token signing for the SigningMethod
				For this signing method, must be an *rsa.PrivateKey structure.

			(*SigningMethodRSA) Verify(signingString string, sig []byte, key interface{}) error
				Verify implements token verification for the SigningMethod
				For this signing method, must be an *rsa.PublicKey structure.

		Implements (at least one exported)
			*SigningMethodRSA : SigningMethod
		As Types Of (total 3, all are exported)
			  var SigningMethodRS256 *SigningMethodRSA
			  var SigningMethodRS384 *SigningMethodRSA
			  var SigningMethodRS512 *SigningMethodRSA

	 type SigningMethodRSAPSS (struct)
		SigningMethodRSAPSS implements the RSAPSS family of signing methods signing methods

		Fields (total 5, all are exported)
			Options *rsa.PSSOptions
			SigningMethodRSA *SigningMethodRSA
			SigningMethodRSA.Hash crypto.Hash
			SigningMethodRSA.Name string
			VerifyOptions *rsa.PSSOptions
				VerifyOptions is optional. If set overrides Options for rsa.VerifyPPS.
				Used to accept tokens signed with rsa.PSSSaltLengthAuto, what doesn't follow
				https://tools.ietf.org/html/rfc7518#section-3.5 but was used previously.
				See https://github.com/dgrijalva/jwt-go/issues/285#issuecomment-437451244 for details.

		Methods (total 3, all are exported)
			( SigningMethodRSAPSS) Alg() string
			(*SigningMethodRSAPSS) Sign(signingString string, key interface{}) ([]byte, error)
				Sign implements token signing for the SigningMethod.
				For this signing method, key must be an rsa.PrivateKey struct

			(*SigningMethodRSAPSS) Verify(signingString string, sig []byte, key interface{}) error
				Verify implements token verification for the SigningMethod.
				For this verify method, key must be an rsa.PublicKey struct

		Implements (at least one exported)
			*SigningMethodRSAPSS : SigningMethod
		As Types Of (total 3, all are exported)
			  var SigningMethodPS256 *SigningMethodRSAPSS
			  var SigningMethodPS384 *SigningMethodRSAPSS
			  var SigningMethodPS512 *SigningMethodRSAPSS

	 type Token (struct)
		Token represents a JWT Token.  Different fields will be used depending on
		whether you're creating or parsing/verifying a token.

		Fields (total 6, all are exported)
			Claims Claims
				// Claims is the second segment of the token in decoded form

			Header map[string]interface{}
				// Header is the first segment of the token in decoded form

			Method SigningMethod
				// Method is the signing method used or to be used

			Raw string
				// Raw contains the raw token.  Populated when you [Parse] a token

			Signature []byte
				// Signature is the third segment of the token in decoded form.  Populated when you Parse a token

			Valid bool
				// Valid specifies if the token is valid.  Populated when you Parse/Verify a token

		Methods (total 3, all are exported)
			(*Token) EncodeSegment(seg []byte) string
				EncodeSegment encodes a JWT specific base64url encoding with padding
				stripped. In the future, this function might take into account a
				[TokenOption]. Therefore, this function exists as a method of [Token], rather
				than a global function.

			(*Token) SignedString(key interface{}) (string, error)
				SignedString creates and returns a complete, signed JWT. The token is signed
				using the SigningMethod specified in the token. Please refer to
				https://golang-jwt.github.io/jwt/usage/signing_methods/#signing-methods-and-key-types
				for an overview of the different signing methods and their respective key
				types.

			(*Token) SigningString() (string, error)
				SigningString generates the signing string.  This is the most expensive part
				of the whole deal. Unless you need this for something special, just go
				straight for the SignedString.

		As Outputs Of (at least 7, all are exported)
			func New(method SigningMethod, opts ...TokenOption) *Token
			func NewWithClaims(method SigningMethod, claims Claims, opts ...TokenOption) *Token
			func Parse(tokenString string, keyFunc Keyfunc, options ...ParserOption) (*Token, error)
			func ParseWithClaims(tokenString string, claims Claims, keyFunc Keyfunc, options ...ParserOption) (*Token, error)
			func (*Parser).Parse(tokenString string, keyFunc Keyfunc) (*Token, error)
			func (*Parser).ParseUnverified(tokenString string, claims Claims) (token *Token, parts []string, err error)
			func (*Parser).ParseWithClaims(tokenString string, claims Claims, keyFunc Keyfunc) (*Token, error)

	 type TokenOption (func)
		TokenOption is a reserved type, which provides some forward compatibility,
		if we ever want to introduce token creation-related options.

		As Inputs Of (at least 2, both are exported)
			func New(method SigningMethod, opts ...TokenOption) *Token
			func NewWithClaims(method SigningMethod, claims Claims, opts ...TokenOption) *Token

	 type Validator (struct)
		Validator is the core of the new Validation API. It is automatically used by
		a [Parser] during parsing and can be modified with various parser options.
		
		The [NewValidator] function should be used to create an instance of this
		struct.

		Fields (total 7, none are exported)
			/* 7 unexporteds ... *//* 7 unexporteds: */
			expectedAud string
				expectedAud contains the audience this token expects. Supplying an empty
				string will disable aud checking.

			expectedIss string
				expectedIss contains the issuer this token expects. Supplying an empty
				string will disable iss checking.

			expectedSub string
				expectedSub contains the subject this token expects. Supplying an empty
				string will disable sub checking.

			leeway time.Duration
				leeway is an optional leeway that can be provided to account for clock skew.

			requireExp bool
				requireExp specifies whether the exp claim is required

			timeFunc func() time.Time
				timeFunc is used to supply the current time that is needed for
				validation. If unspecified, this defaults to time.Now.

			verifyIat bool
				verifyIat specifies whether the iat (Issued At) claim will be verified.
				According to https://www.rfc-editor.org/rfc/rfc7519#section-4.1.6 this
				only specifies the age of the token, but no validation check is
				necessary. However, if wanted, it can be checked if the iat is
				unrealistic, i.e., in the future.

		Methods (total 7, in which 1 is exported)
			(*Validator) Validate(claims Claims) error
				Validate validates the given claims. It will also perform any custom
				validation if claims implements the [ClaimsValidator] interface.
				
				Note: It will NOT perform any *signature verification* on the token that
				contains the claims and expects that the [Claim] was already successfully
				verified.

			/* 6 unexporteds ... *//* 6 unexporteds: */
			(*Validator) verifyAudience(claims Claims, cmp string, required bool) error
				verifyAudience compares the aud claim against cmp.
				
				If aud is not set or an empty list, it will succeed if the claim is not required,
				otherwise ErrTokenRequiredClaimMissing will be returned.
				
				Additionally, if any error occurs while retrieving the claim, e.g., when its
				the wrong type, an ErrTokenUnverifiable error will be returned.

			(*Validator) verifyExpiresAt(claims Claims, cmp time.Time, required bool) error
				verifyExpiresAt compares the exp claim in claims against cmp. This function
				will succeed if cmp < exp. Additional leeway is taken into account.
				
				If exp is not set, it will succeed if the claim is not required,
				otherwise ErrTokenRequiredClaimMissing will be returned.
				
				Additionally, if any error occurs while retrieving the claim, e.g., when its
				the wrong type, an ErrTokenUnverifiable error will be returned.

			(*Validator) verifyIssuedAt(claims Claims, cmp time.Time, required bool) error
				verifyIssuedAt compares the iat claim in claims against cmp. This function
				will succeed if cmp >= iat. Additional leeway is taken into account.
				
				If iat is not set, it will succeed if the claim is not required,
				otherwise ErrTokenRequiredClaimMissing will be returned.
				
				Additionally, if any error occurs while retrieving the claim, e.g., when its
				the wrong type, an ErrTokenUnverifiable error will be returned.

			(*Validator) verifyIssuer(claims Claims, cmp string, required bool) error
				verifyIssuer compares the iss claim in claims against cmp.
				
				If iss is not set, it will succeed if the claim is not required,
				otherwise ErrTokenRequiredClaimMissing will be returned.
				
				Additionally, if any error occurs while retrieving the claim, e.g., when its
				the wrong type, an ErrTokenUnverifiable error will be returned.

			(*Validator) verifyNotBefore(claims Claims, cmp time.Time, required bool) error
				verifyNotBefore compares the nbf claim in claims against cmp. This function
				will return true if cmp >= nbf. Additional leeway is taken into account.
				
				If nbf is not set, it will succeed if the claim is not required,
				otherwise ErrTokenRequiredClaimMissing will be returned.
				
				Additionally, if any error occurs while retrieving the claim, e.g., when its
				the wrong type, an ErrTokenUnverifiable error will be returned.

			(*Validator) verifySubject(claims Claims, cmp string, required bool) error
				verifySubject compares the sub claim against cmp.
				
				If sub is not set, it will succeed if the claim is not required,
				otherwise ErrTokenRequiredClaimMissing will be returned.
				
				Additionally, if any error occurs while retrieving the claim, e.g., when its
				the wrong type, an ErrTokenUnverifiable error will be returned.

		As Outputs Of (at least one exported)
			func NewValidator(opts ...ParserOption) *Validator

	 type VerificationKey (interface)
		VerificationKey represents a public or secret key for verifying a token's signature.

	 type VerificationKeySet (struct)
		VerificationKeySet is a set of public or secret keys. It is used by the parser to verify a token.

		Fields (only one, which is exported)
			Keys []VerificationKey

	/* 3 unexporteds ... *//* 3 unexporteds: */
	 type joinedError (struct)
		joinedError is an error type that works similar to what [errors.Join]
		produces, with the exception that it has a nice error string; mainly its
		error messages are concatenated using a comma, rather than a newline.

		Fields (only one, which is unexported)
			/* one unexported ... *//* one unexported: */
			errs []error
		Methods (total 2, both are exported)
			( joinedError) Error() string
			( joinedError) Unwrap() []error
				Unwrap implements the multiple error unwrapping for this error type, which is
				possible in Go 1.20.

		Implements (at least one exported)
			 joinedError : error

	 type signingMethodNone (struct)

		Methods (total 3, all are exported)
			(*signingMethodNone) Alg() string
			(*signingMethodNone) Sign(signingString string, key interface{}) ([]byte, error)
				Only allow 'none' signing if UnsafeAllowNoneSignatureType is specified as the key

			(*signingMethodNone) Verify(signingString string, sig []byte, key interface{}) (err error)
				Only allow 'none' alg type if UnsafeAllowNoneSignatureType is specified as the key

		Implements (at least one exported)
			*signingMethodNone : SigningMethod
		As Types Of (only one, which is exported)
			  var SigningMethodNone *signingMethodNone

	 type unsafeNoneMagicConstant string (basic type)

		As Types Of (only one, which is exported)
			const UnsafeAllowNoneSignatureType


Package-Level Functions (total 41, in which 29 are exported)

	 func GetAlgorithms() (algs []string)
		GetAlgorithms returns a list of registered "alg" names

	 func GetSigningMethod(alg string) (method SigningMethod)
		GetSigningMethod retrieves a signing method from an "alg" string

	 func New(method SigningMethod, opts ...TokenOption) *Token
		New creates a new [Token] with the specified signing method and an empty map
		of claims. Additional options can be specified, but are currently unused.

	 func NewNumericDate(t time.Time) *NumericDate
		NewNumericDate constructs a new *NumericDate from a standard library time.Time struct.
		It will truncate the timestamp according to the precision specified in TimePrecision.

	 func NewParser(options ...ParserOption) *Parser
		NewParser creates a new Parser with the specified options

	 func NewValidator(opts ...ParserOption) *Validator
		NewValidator can be used to create a stand-alone validator with the supplied
		options. This validator can then be used to validate already parsed claims.
		
		Note: Under normal circumstances, explicitly creating a validator is not
		needed and can potentially be dangerous; instead functions of the [Parser]
		class should be used.
		
		The [Validator] is only checking the *validity* of the claims, such as its
		expiration time, but it does NOT perform *signature verification* of the
		token.

	 func NewWithClaims(method SigningMethod, claims Claims, opts ...TokenOption) *Token
		NewWithClaims creates a new [Token] with the specified signing method and
		claims. Additional options can be specified, but are currently unused.

	 func Parse(tokenString string, keyFunc Keyfunc, options ...ParserOption) (*Token, error)
		Parse parses, validates, verifies the signature and returns the parsed token.
		keyFunc will receive the parsed token and should return the cryptographic key
		for verifying the signature. The caller is strongly encouraged to set the
		WithValidMethods option to validate the 'alg' claim in the token matches the
		expected algorithm. For more details about the importance of validating the
		'alg' claim, see
		https://auth0.com/blog/critical-vulnerabilities-in-json-web-token-libraries/

	 func ParseECPrivateKeyFromPEM(key []byte) (*ecdsa.PrivateKey, error)
		ParseECPrivateKeyFromPEM parses a PEM encoded Elliptic Curve Private Key Structure

	 func ParseECPublicKeyFromPEM(key []byte) (*ecdsa.PublicKey, error)
		ParseECPublicKeyFromPEM parses a PEM encoded PKCS1 or PKCS8 public key

	 func ParseEdPrivateKeyFromPEM(key []byte) (crypto.PrivateKey, error)
		ParseEdPrivateKeyFromPEM parses a PEM-encoded Edwards curve private key

	 func ParseEdPublicKeyFromPEM(key []byte) (crypto.PublicKey, error)
		ParseEdPublicKeyFromPEM parses a PEM-encoded Edwards curve public key

	 func ParseRSAPrivateKeyFromPEM(key []byte) (*rsa.PrivateKey, error)
		ParseRSAPrivateKeyFromPEM parses a PEM encoded PKCS1 or PKCS8 private key

	 func ParseRSAPrivateKeyFromPEMWithPassword(key []byte, password string) (*rsa.PrivateKey, error)
		ParseRSAPrivateKeyFromPEMWithPassword parses a PEM encoded PKCS1 or PKCS8 private key protected with password
		
		Deprecated: This function is deprecated and should not be used anymore. It uses the deprecated x509.DecryptPEMBlock
		function, which was deprecated since RFC 1423 is regarded insecure by design. Unfortunately, there is no alternative
		in the Go standard library for now. See https://github.com/golang/go/issues/8860.

	 func ParseRSAPublicKeyFromPEM(key []byte) (*rsa.PublicKey, error)
		ParseRSAPublicKeyFromPEM parses a certificate or a PEM encoded PKCS1 or PKIX public key

	 func ParseWithClaims(tokenString string, claims Claims, keyFunc Keyfunc, options ...ParserOption) (*Token, error)
		ParseWithClaims is a shortcut for NewParser().ParseWithClaims().
		
		Note: If you provide a custom claim implementation that embeds one of the
		standard claims (such as RegisteredClaims), make sure that a) you either
		embed a non-pointer version of the claims or b) if you are using a pointer,
		allocate the proper memory for it before passing in the overall claims,
		otherwise you might run into a panic.

	 func RegisterSigningMethod(alg string, f func() SigningMethod)
		RegisterSigningMethod registers the "alg" name and a factory function for signing method.
		This is typically done during init() in the method's implementation

	 func WithAudience(aud string) ParserOption
		WithAudience configures the validator to require the specified audience in
		the `aud` claim. Validation will fail if the audience is not listed in the
		token or the `aud` claim is missing.
		
		NOTE: While the `aud` claim is OPTIONAL in a JWT, the handling of it is
		application-specific. Since this validation API is helping developers in
		writing secure application, we decided to REQUIRE the existence of the claim,
		if an audience is expected.

	 func WithExpirationRequired() ParserOption
		WithExpirationRequired returns the ParserOption to make exp claim required.
		By default exp claim is optional.

	 func WithIssuedAt() ParserOption
		WithIssuedAt returns the ParserOption to enable verification
		of issued-at.

	 func WithIssuer(iss string) ParserOption
		WithIssuer configures the validator to require the specified issuer in the
		`iss` claim. Validation will fail if a different issuer is specified in the
		token or the `iss` claim is missing.
		
		NOTE: While the `iss` claim is OPTIONAL in a JWT, the handling of it is
		application-specific. Since this validation API is helping developers in
		writing secure application, we decided to REQUIRE the existence of the claim,
		if an issuer is expected.

	 func WithJSONNumber() ParserOption
		WithJSONNumber is an option to configure the underlying JSON parser with
		UseNumber.

	 func WithLeeway(leeway time.Duration) ParserOption
		WithLeeway returns the ParserOption for specifying the leeway window.

	 func WithoutClaimsValidation() ParserOption
		WithoutClaimsValidation is an option to disable claims validation. This
		option should only be used if you exactly know what you are doing.

	 func WithPaddingAllowed() ParserOption
		WithPaddingAllowed will enable the codec used for decoding JWTs to allow
		padding. Note that the JWS RFC7515 states that the tokens will utilize a
		Base64url encoding with no padding. Unfortunately, some implementations of
		JWT are producing non-standard tokens, and thus require support for decoding.

	 func WithStrictDecoding() ParserOption
		WithStrictDecoding will switch the codec used for decoding JWTs into strict
		mode. In this mode, the decoder requires that trailing padding bits are zero,
		as described in RFC 4648 section 3.5.

	 func WithSubject(sub string) ParserOption
		WithSubject configures the validator to require the specified subject in the
		`sub` claim. Validation will fail if a different subject is specified in the
		token or the `sub` claim is missing.
		
		NOTE: While the `sub` claim is OPTIONAL in a JWT, the handling of it is
		application-specific. Since this validation API is helping developers in
		writing secure application, we decided to REQUIRE the existence of the claim,
		if a subject is expected.

	 func WithTimeFunc(f func() time.Time) ParserOption
		WithTimeFunc returns the ParserOption for specifying the time func. The
		primary use-case for this is testing. If you are looking for a way to account
		for clock-skew, WithLeeway should be used instead.

	 func WithValidMethods(methods []string) ParserOption
		WithValidMethods is an option to supply algorithm methods that the parser
		will check. Only those methods will be considered valid. It is heavily
		encouraged to use this option in order to prevent attacks such as
		https://auth0.com/blog/critical-vulnerabilities-in-json-web-token-libraries/.

	/* 12 unexporteds ... *//* 12 unexporteds: */
	 func errorIfFalse(value bool, err error) error
		errorIfFalse returns the error specified in err, if the value is true.
		Otherwise, nil is returned.

	 func errorIfRequired(required bool, claim string) error
		errorIfRequired returns an ErrTokenRequiredClaimMissing error if required is
		true. Otherwise, nil is returned.

	 func init()
	 func init()
	 func init()
	 func init()
	 func init()
	 func init()
	 func joinErrors(errs ...error) error
		joinErrors joins together multiple errors. Useful for scenarios where
		multiple errors next to each other occur, e.g., in claims validation.

	 func newError(message string, err error, more ...error) error
		newError creates a new error message with a detailed error message. The
		message will be prefixed with the contents of the supplied error type.
		Additionally, more errors, that provide more context can be supplied which
		will be appended to the message. This makes use of Go 1.20's possibility to
		include more than one %w formatting directive in [fmt.Errorf].
		
		For example,
		
			newError("no keyfunc was provided", ErrTokenUnverifiable)
		
		will produce the error string
		
			"token is unverifiable: no keyfunc was provided"

	 func newNumericDateFromSeconds(f float64) *NumericDate
		newNumericDateFromSeconds creates a new *NumericDate out of a float64 representing a
		UNIX epoch with the float fraction representing non-integer seconds.

	 func splitToken(token string) ([]string, bool)
		splitToken splits a token string into three parts: header, claims, and signature. It will only
		return true if the token contains exactly two delimiters and three parts. In all other cases, it
		will return nil parts and false.


Package-Level Variables (total 45, in which 43 are exported)

	  var ErrECDSAVerification error
		Sadly this is missing from crypto/ecdsa compared to crypto/rsa

	  var ErrEd25519Verification error
	  var ErrHashUnavailable error
	  var ErrInvalidKey error
	  var ErrInvalidKeyType error
	  var ErrInvalidType error
	  var ErrKeyMustBePEMEncoded error
	  var ErrNotECPrivateKey error
	  var ErrNotECPublicKey error
	  var ErrNotEdPrivateKey error
	  var ErrNotEdPublicKey error
	  var ErrNotRSAPrivateKey error
	  var ErrNotRSAPublicKey error
	  var ErrSignatureInvalid error
		Specific instances for HS256 and company

	  var ErrTokenExpired error
	  var ErrTokenInvalidAudience error
	  var ErrTokenInvalidClaims error
	  var ErrTokenInvalidId error
	  var ErrTokenInvalidIssuer error
	  var ErrTokenInvalidSubject error
	  var ErrTokenMalformed error
	  var ErrTokenNotValidYet error
	  var ErrTokenRequiredClaimMissing error
	  var ErrTokenSignatureInvalid error
	  var ErrTokenUnverifiable error
	  var ErrTokenUsedBeforeIssued error
	  var MarshalSingleStringAsArray bool
		MarshalSingleStringAsArray modifies the behavior of the ClaimStrings type,
		especially its MarshalJSON function.
		
		If it is set to true (the default), it will always serialize the type as an
		array of strings, even if it just contains one element, defaulting to the
		behavior of the underlying []string. If it is set to false, it will serialize
		to a single string, if it contains one element. Otherwise, it will serialize
		to an array of strings.

	  var NoneSignatureTypeDisallowedError error
	  var SigningMethodEdDSA *SigningMethodEd25519
		Specific instance for EdDSA

	  var SigningMethodES256 *SigningMethodECDSA
		Specific instances for EC256 and company

	  var SigningMethodES384 *SigningMethodECDSA
		Specific instances for EC256 and company

	  var SigningMethodES512 *SigningMethodECDSA
		Specific instances for EC256 and company

	  var SigningMethodHS256 *SigningMethodHMAC
		Specific instances for HS256 and company

	  var SigningMethodHS384 *SigningMethodHMAC
		Specific instances for HS256 and company

	  var SigningMethodHS512 *SigningMethodHMAC
		Specific instances for HS256 and company

	  var SigningMethodNone *signingMethodNone
		SigningMethodNone implements the none signing method.  This is required by the spec
		but you probably should never use it.

	  var SigningMethodPS256 *SigningMethodRSAPSS
		Specific instances for RS/PS and company.

	  var SigningMethodPS384 *SigningMethodRSAPSS
		Specific instances for RS/PS and company.

	  var SigningMethodPS512 *SigningMethodRSAPSS
		Specific instances for RS/PS and company.

	  var SigningMethodRS256 *SigningMethodRSA
		Specific instances for RS256 and company

	  var SigningMethodRS384 *SigningMethodRSA
		Specific instances for RS256 and company

	  var SigningMethodRS512 *SigningMethodRSA
		Specific instances for RS256 and company

	  var TimePrecision time.Duration
		TimePrecision sets the precision of times and dates within this library. This
		has an influence on the precision of times when comparing expiry or other
		related time fields. Furthermore, it is also the precision of times when
		serializing.
		
		For backwards compatibility the default precision is set to seconds, so that
		no fractional timestamps are generated.

	/* 2 unexporteds ... *//* 2 unexporteds: */
	  var signingMethodLock *sync.RWMutex
	  var signingMethods map[string]func() SigningMethod
Package-Level Constants (total 2, in which 1 is exported)

	const UnsafeAllowNoneSignatureType unsafeNoneMagicConstant = "none signing method allowed"
	/* one unexported ... *//* one unexported: */
	const tokenDelimiter = "."

The pages are generated with Golds v0.7.6. (GOOS=linux GOARCH=amd64)
Golds is a Go 101 project developed by Tapir Liu.
PR and bug reports are welcome and can be submitted to the issue list.
Please follow @zigo_101 (reachable from the left QR code) to get the latest news of Golds.