Huck Auth API

auth.rust.solutions is a minimal JWT (HS256) issuer and verifier. All requests except GET /healthz require the header:

Authorization: Bearer <token>

where <token> is the Huck management token (HUCK_TOKEN).

Endpoints

POST /token

Issue a signed HS256 JWT. The signing key is server-side only (HUCK_SIGNING_KEY env, never exposed).

Request

{
  "sub": "user-id-or-name"
}

sub must be 1–256 characters.

Response

{
  "token": "eyJhbGci...",
  "expires_in": 3600
}

Tokens expire 1 hour after issuance. The token is signed with HMAC-SHA256; the key is held only by the server.

GET /verify

Verify a JWT passed as a Bearer token. Returns the decoded claims if valid, or a 401 error if expired, malformed, or signature-mismatched.

Request

Authorization: Bearer <jwt>

Response

{
  "sub": "user-id-or-name",
  "iat": 1693000000,
  "exp": 1693003600
}

Example

# Issue a token
curl -X POST https://auth.rust.solutions/token \
  -H "Authorization: Bearer $HUCK_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"sub":"my-app"}'

# Verify it
curl https://auth.rust.solutions/verify \
  -H "Authorization: Bearer <jwt-from-above>"

Security Notes

• Tokens are HS256-signed; the signing key never leaves the server.
• Expired tokens are rejected with 401.
• This service is not public — the management token is required for both issuing and verifying.
• JWTs do not support revocation; a token is valid until its exp.