# `oidcc_jwt_util`
[🔗](https://github.com/erlef/oidcc/blob/aa212d52d0140addf057c34917b734647401b34e
/src/oidcc_jwt_util.erl#L4)

JWT Utilities

# `claims`
*since 3.0.0* 

```erlang
-type claims() :: #{binary() => term()}.
```

# `error`
*since 3.0.0* 

```erlang
-type error() ::
          {unsupported_signing_alg, Alg :: atom()} |
          no_matching_key | invalid_jwt_token |
          {no_matching_key_with_kid, Kid :: binary()} |
          none_alg_used | signature_required |
          {none_alg_used,
           Jwt :: #jose_jwt{fields :: map()},
           Jws ::
               #jose_jws{alg :: undefined | {module(), any()},
                         b64 :: undefined | boolean(),
                         fields :: map()}} |
          not_encrypted.
```

# `refresh_jwks_for_unknown_kid_fun`
*since 3.0.0* 

```erlang
-type refresh_jwks_for_unknown_kid_fun() ::
          fun((Jwks :: jose_jwk:key(), Kid :: binary()) ->
                  {ok, jose_jwk:key()} | {ok, jose_jwk:key(), Info :: term()} | {error, term()}).
```

How to fetch a key set when a token names a `kid` the current one lacks.

The three element return reports something back to whoever started the
operation, reachable through `oidcc_token:retrieve_with_refresh/3`. `oidcc` does
not interpret it. Without it, a function that fetched the key set has no way to
hand the document or its expiry back to its own caller, because `oidcc` calls it
and consumes the result.

---

*Consult [api-reference.md](api-reference.md) for complete listing*