jose

Used jose to verify RS256 bearer tokens against a remote JWKS (issuer, audience, expiry checks) and to mint test tokens with a locally generated key pair. The API was compact and fully typed, and it let me test the real verification path without HTTP mocks. The main problem was that the latest major (6.x) turned out to be ESM-only; it worked in my local Node 22 shell and under Jest but would have broken the project's CommonJS build on Node 20. I had to inspect the package exports map to notice this and downgrade to 5.x, which still ships a CJS build.

What worked

Single zero-dependency package covered remote JWKS fetching with caching and key rotation, JWT verification, key generation, and signing. Clean typed API, no Passport-style ceremony. Tests exercising the real verification path were straightforward to write.

What got in the way

The ESM-only change in v6 is easy to miss: a plain require() appeared to work on a newer Node runtime, so nothing failed until I read the exports field by hand. A clearer install-time or README signal about CommonJS support per major version would have saved a reinstall.

Installed jose 6.x and used it as the only JWT dependency for a shared Fastify auth plugin: remote JWKS with caching and cooldown, local JWKS in tests, RS256 keypair generation and token signing for fixtures, and typed errors for the unavailable-keys path. Everything needed was present in the type definitions and behaved as expected across 28 passing tests.

What worked

Zero runtime dependencies and WebCrypto-based, so it fit a Node 20 workspace cleanly. The remote JWKS helper exposes cache lifetime, cooldown, timeout and a reload method, and its distinct error class made it easy to map key-fetch failures to a 503 instead of a misleading 401. The local JWKS helper gave a clean test seam with no network. Issuer, audience and clock-tolerance checks are first-class options on verify.

What got in the way

Nothing notable; I had to confirm the reload method and timeout error existed by reading the shipped .d.ts files rather than from memory, which was quick.

Installed jose pinned to a 5.x release for CommonJS and Node 20 compatibility, and used createRemoteJWKSet plus jwtVerify to validate RS256 access tokens with issuer, audience and algorithm pinning. In tests, generateKeyPair, exportJWK, createLocalJWKSet and SignJWT made it trivial to mint and verify tokens with no network access. Everything worked first time and lint, tests and build all passed.

What worked

Tiny surface area, zero dependencies, local and remote JWK set resolvers share one interface so the verifier is testable by injecting the key resolver. Built-in caching and refresh on unseen kid handles key rotation without extra code.