(Tcl) Create JWT using a Brainpool EC Key

See more JSON Web Token (JWT) Examples

Demonstrates how to create a JWT using an EC private key. This is for JOSE headers having an "alg" member with any of the following values:

• BP160R1
• BP192R1
• BP224R1
• BP256R1
• BP320R1
• BP384R1
• BP512R1

This example also demonstrates how to include time constraints:

• nbf: Not Before Time
• exp: Expiration Time
• iat: Issue At Time

Chilkat Tcl Extension Downloads Chilkat Tcl Extension Downloads

load ./chilkat.dll

# Demonstrates how to create a JWT using a brainpool EC private key.

# This example requires the Chilkat API to have been previously unlocked.
# See Global Unlock Sample for sample code.

set privKey [new_CkPrivateKey]

# Load a brainpool EC key.
set success [CkPrivateKey_LoadPemFile $privKey "c:/qa_data/pem/ec_brainpool_privKey.pem"]
if {$success != 1} then {
    puts [CkPrivateKey_lastErrorText $privKey]
    delete_CkPrivateKey $privKey
    exit
}

# You can examine the curve name of the key you just loaded by getting the private in XML format:
# <ECCKeyValue curve="CURVE_NAME">...</ECCKeyValue>
puts [CkPrivateKey_getXml $privKey]

set jwt [new_CkJwt]

# Build the JOSE header
set jose [new_CkJsonObject]

# Use the brainpool curve name matching the private key you just loaded.
# Use "BP256R1", or "BP384R1", etc.   
set success [CkJsonObject_AppendString $jose "alg" "BP256R1"]
set success [CkJsonObject_AppendString $jose "typ" "JWT"]

# Now build the JWT claims (also known as the payload)
set claims [new_CkJsonObject]

set success [CkJsonObject_AppendString $claims "iss" "http://example.org"]
set success [CkJsonObject_AppendString $claims "sub" "John"]
set success [CkJsonObject_AppendString $claims "aud" "http://example.com"]

# Set the timestamp of when the JWT was created to now.
set curDateTime [CkJwt_GenNumericDate $jwt 0]
set success [CkJsonObject_AddIntAt $claims -1 "iat" $curDateTime]

# Set the "not process before" timestamp to now.
set success [CkJsonObject_AddIntAt $claims -1 "nbf" $curDateTime]

# Set the timestamp defining an expiration time (end time) for the token
# to be now + 1 hour (3600 seconds)
set success [CkJsonObject_AddIntAt $claims -1 "exp" [expr $curDateTime + 3600]]

# Produce the smallest possible JWT:
CkJwt_put_AutoCompact $jwt 1

# Create the JWT token.  This is where the ECC signature is created.
set token [CkJwt_createJwtPk $jwt [CkJsonObject_emit $jose] [CkJsonObject_emit $claims] $privKey]

puts "$token"

delete_CkPrivateKey $privKey
delete_CkJwt $jwt
delete_CkJsonObject $jose
delete_CkJsonObject $claims