Bash / Unix Shell JWT Generator

Bash / Unix Shell JWT generator quickstart

Create a token with your public API key in the sub claim, a near-term Unix timestamp in exp, and an HS256 signature made with your private API key.

Sapling JWTs use HS256 with a sub claim containing your public API key and an exp claim containing a Unix timestamp. The examples use a one-hour lifetime; shorten it further when your application can refresh tokens easily.

Bash / Unix Shell HS256 · sub + exp

This example uses jq for JSON and OpenSSL for the HS256 signature.

#!/usr/bin/env bash
set -euo pipefail

: "${SAPLING_PUBLIC_KEY:?Set SAPLING_PUBLIC_KEY first.}"
: "${SAPLING_PRIVATE_KEY:?Set SAPLING_PRIVATE_KEY first.}"

base64url() {
  openssl base64 -A | tr '+/' '-_' | tr -d '='
}

header=$(printf '%s' '{"alg":"HS256","typ":"JWT"}' | base64url)
expires_at=$(( $(date +%s) + 3600 ))
payload=$(jq -nc \
  --arg sub "$SAPLING_PUBLIC_KEY" \
  --argjson exp "$expires_at" \
  '{sub: $sub, exp: $exp}' | base64url)

signing_input="${header}.${payload}"
signature=$(printf '%s' "$signing_input" \
  | openssl dgst -sha256 -hmac "$SAPLING_PRIVATE_KEY" -binary \
  | base64url)

printf '%s.%s\n' "$signing_input" "$signature"

Generated token text/plain

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.<base64url-claims>.<signature>

Return the compact token to the browser and pass it to Sapling.init as the key. Issue a fresh token after it expires; never send the private key.

Reference Frontend key management and JWT documentation All languages Choose another quickstart

About Bash / Unix Shell

Bash is a command-line interpreter that provides an interface for Unix-like operating systems. It's a popular scripting language for Unix, Linux, and macOS.