import time
import oxyjwt

secret = "your-256-bit-secret"
payload = {
    "sub": "user_42",
    "role": "admin",
    "iss": "https://auth.example.com",
    "aud": "https://api.example.com",
    "exp": int(time.time()) + 3600,
}

# Encode a token
token = oxyjwt.encode(payload, secret, algorithm="HS256", headers={"kid": "key-2026"})

# Decode and validate claims
claims = oxyjwt.decode(
    token,
    secret,
    algorithms=["HS256"],  # Fixed allow-list is required
    audience="https://api.example.com",
    issuer="https://auth.example.com",
)
print(claims["sub"])  # "user_42"

import oxyjwt

# Load keys
signing_key = oxyjwt.EncodingKey.from_rsa_pem(private_pem_bytes)
verifying_key = oxyjwt.DecodingKey.from_rsa_pem(public_pem_bytes)

# Sign with RS256
token = oxyjwt.encode({"sub": "user_42"}, signing_key, algorithm="RS256")

# Verify with RS256
claims = oxyjwt.decode(token, verifying_key, algorithms=["RS256"])

signing_key = oxyjwt.EncodingKey.from_ed_pem(ed25519_private_pem)
verifying_key = oxyjwt.DecodingKey.from_ed_pem(ed25519_public_pem)

token = oxyjwt.encode({"sub": "service-worker"}, signing_key, algorithm="EdDSA")
claims = oxyjwt.decode(token, verifying_key, algorithms=["EdDSA"])

from oxyjwt import PyJWKClient
import oxyjwt

jwks_client = PyJWKClient(
    "https://your-domain.auth0.com/.well-known/jwks.json",
    cache_keys=True,
    max_cached_keys=16,
    cache_jwk_set=True,
    lifespan=3600,  # 1 hour cache
)

# Automatically resolve the signing key using the token's header `kid`
signing_key = jwks_client.get_signing_key_from_jwt(token)

claims = oxyjwt.decode(
    token,
    signing_key.key,
    algorithms=["RS256"],
    audience="https://api.example.com",
)

import oxyjwt

# Inspect headers without verifying signature (debugging only)
header = oxyjwt.get_unverified_header(token)

# Retrieve header, claims payload, and raw signature together
token_data = oxyjwt.decode_complete(token, key, algorithms=["HS256"])
print(token_data["header"])
print(token_data["payload"])
print(token_data["signature"])

import oxyjwt

try:
    claims = oxyjwt.decode(token, key, algorithms=["HS256"])
except oxyjwt.ExpiredSignatureError:
    # Token has expired (exp claim)
    ...
except oxyjwt.ImmatureSignatureError:
    # Token is not yet valid (nbf claim)
    ...
except oxyjwt.InvalidAudienceError:
    # Audience claim mismatch (aud claim)
    ...
except oxyjwt.InvalidIssuerError:
    # Issuer mismatch (iss claim)
    ...
except oxyjwt.InvalidSignatureError:
    # Signature verification failed
    ...
except oxyjwt.InvalidTokenError:
    # Malformed token or general decoding error
    ...
except oxyjwt.OxyJWTError:
    # Base class for all OxyJWT exceptions
    ...