oidc.id-token
Generic ID token validation for any OIDC provider.
Provides a high-level API for validating ID tokens from any OIDC-compliant provider (Google, Apple, Microsoft, etc.). Handles discovery document fetching, JWKS retrieval, signature validation, and claims verification.
Usage: ;; JVM (synchronous) (let validator (create-validator) (validate validator {:id-token “eyJhbG…” :issuer “https://accounts.google.com” :audience “your-client-id”})) ;; => {:valid? true :claims {:sub “…” :email “…” …}}
;; ClojureScript (returns Promise) (-> (validate validator opts) (.then #(println “Claims:” (:claims %))))
create-validator
(create-validator)Creates an ID token validator.
The validator caches discovery documents and JWKS to minimize network requests. Cache TTL is 1 hour by default.
Returns: A validator map containing the discovery client and JWT validator.
extract-email
(extract-email claims)Extracts the email from validated claims.
Returns the email only if email_verified is true (or not present, as some providers don’t include it when email is always verified).
extract-subject
(extract-subject claims)Extracts the subject (user ID) from validated claims.
The subject is the unique identifier for the user within the provider’s system. This value is stable across logins for the same user.
token-expired?
(token-expired? claims)Checks if a token’s expiration time has passed.
Takes the claims from a validated token and returns true if the token has expired. Returns false if no exp claim is present. Useful for checking cached tokens.
validate
(validate {:keys [discovery-client jwt-validator]} {:keys [id-token issuer audience nonce]})Validates an ID token from any OIDC provider (JVM, synchronous).
Arguments: validator - Created by create-validator opts - Map with: :id-token - The JWT ID token string :issuer - Expected issuer URL (e.g., ‘https://accounts.google.com’) :audience - Expected audience (your client ID) :nonce (optional) - Expected nonce value for replay protection
Returns: {:valid? true :claims {…}} on success {:valid? false :error “description”} on failure