accounts/dist/server/Identity.d.ts

Tempo Accounts SDK

/**
 * Verifies an OIDC identity token (JWT) against an issuer's JWKS and returns its
 * claims. Asserts the signature, `iss`, `aud`, and `exp` (via `jose`), plus
 * `email_verified === true`. Optionally cross-checks `sub` (the account address)
 * and `nonce` when provided. Throws on any failure.
 *
 * Standalone counterpart to `Handler.auth({ identity })` — use it when minting
 * your own session inside `onAuthenticate` with `session: false`.
 */
export declare function verify(idToken: string, options: verify.Options): Promise<verify.Claims>;
export declare namespace verify {
    type Options = {
        /** Expected audience (`aud`) — the relying party's origin. */
        audience: string;
        /** Issuer (IdP) URL whose JWKS signs the token. */
        issuer: string;
        /** When set, require the token's `nonce` to equal this value. */
        nonce?: string | undefined;
        /** When set, require the token's `sub` to equal this address (case-insensitive). */
        subject?: string | undefined;
    };
    type Claims = {
        /** Verified email, if present. */
        email: string | undefined;
        /** OIDC nonce echoed in the token, if present. */
        nonce: string | undefined;
        /** Token subject (`sub`) — the account address. */
        subject: string;
    };
}
//# sourceMappingURL=Identity.d.ts.map