@moq/auth

The TypeScript twin of moq-auth. RequestSchema and GrantSchema validate what moq-relay POSTs per session and what an auth server answers, so a Worker or a Node server implements the contract with one import. Generate keys (HMAC, RSA, ECDSA, EdDSA, individually or as a JWK set), Key.sign and Key.verify tokens, and authorize a connection path against the claims exactly as moq auth serve does. Tokens are interchangeable with the Rust side. Grants and claims are Pattern unions: foo is one broadcast, foo/** is a subtree, ** is everything.

bash

bun add @moq/auth
bun run @moq/auth generate --out root.jwk
bun run @moq/auth sign --key root.jwk --root "rooms/123" --publish 'alice/**'

Mint tokens on a server, never in the browser, and prefer asymmetric keys so the relay holds only the public half. Example: sign-and-verify.ts.

@moq/auth ​

@moq/auth