feat(backend): [WIP] Add support for M2M JWT creation and verification#7883
feat(backend): [WIP] Add support for M2M JWT creation and verification#7883wobsoriano wants to merge 10 commits intorelease/core-2from
Conversation
Add support for verifying M2M tokens in JWT format, mirroring the existing OAuth JWT verification pattern. Changes: - Add isM2MJwt() to detect M2M JWTs by checking sub claim starts with 'mch_' - Add isMachineJwt() helper to check for any machine JWT (OAuth or M2M) - Update isMachineToken() and getMachineTokenType() to recognize M2M JWTs - Add M2MToken.fromJwtPayload() to create M2MToken from verified JWT payload - Add verifyJwtM2MToken() for local JWT verification using JWKS - Update verifyM2MToken() to route JWT vs opaque token verification - Update request.ts to reject machine JWTs when expecting session tokens - Export isM2MJwt and isMachineJwt from internal.ts
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
🦋 Changeset detectedLatest commit: 9740d2c The changes in this PR will be included in the next version bump. This PR includes changesets to release 11 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
|
Important Review skippedDraft detected. Please check the settings in the CodeRabbit UI or the You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Add support for creating M2M tokens in JWT format in addition to the default opaque format. The tokenFormat parameter accepts 'opaque' (default) or 'jwt'. Changes: - Add tokenFormat parameter to CreateM2MTokenParams type with JSDoc - Pass tokenFormat parameter to BAPI in createToken method - Add comprehensive tests for JWT format, opaque format, default behavior, and JWT with custom claims - Apply linting fixes to machine.test.ts
402db61 to
450ffdc
Compare
@clerk/agent-toolkit
@clerk/astro
@clerk/backend
@clerk/chrome-extension
@clerk/clerk-js
@clerk/dev-cli
@clerk/elements
@clerk/clerk-expo
@clerk/expo-passkeys
@clerk/express
@clerk/fastify
@clerk/localizations
@clerk/nextjs
@clerk/nuxt
@clerk/clerk-react
@clerk/react-router
@clerk/remix
@clerk/shared
@clerk/tanstack-react-start
@clerk/testing
@clerk/themes
@clerk/types
@clerk/upgrade
@clerk/vue
commit: |
Updated test JWT tokens to include: - Header: Added 'kid' field with instance ID - Payload: Added 'jti' field for JWT ID These fields are required by the M2M JWT verification schema at edge (cloudflare-workers#1593) and ensure our tests use realistic JWT tokens that match production behavior. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Description
Checklist
pnpm testruns as expected.pnpm buildruns as expected.Type of change