object

paseto

Facade for PASETO v4 JSON claims encryption, signing, authentication, validation, and key selection.

Availability:
logtalk_load(paseto(loader))
Author: Paulo Moura
Version: 1:0:0
Date: 2026-08-08
Compilation flags:
static, context_switching_calls
Imports:
public paseto_helpers
public paseto_claims_helpers
Uses:
list
paseto_claims
paseto_keys
paseto_v4
Remarks:
(none)
Inherited public predicates:
 check_option/1  check_options/1  default_option/1  default_options/1  option/2  option/3  valid_option/1  valid_options/1

Public predicates

encrypt/4

Encrypts a JSON claims object as a v4.local token.

Compilation flags:
static
Template:
encrypt(Claims,Key,Token,Options)
Mode and number of proofs:
encrypt(+term,+list(byte),-atom,+list(compound)) - one_or_error
Exceptions:
Claims is not a JSON object or contains duplicate members:
domain_error(paseto_json_object,Claims)
Key is not a list of 32 bytes:
type_error(list(byte,32),Key)
The footer kid conflicts with the key_id/1 option:
domain_error(paseto_footer_key_id,Existing-KeyId)
Options is a variable:
instantiation_error
Options is neither a variable nor a list:
type_error(list,Options)
An element Option of the list Options is a variable:
instantiation_error
An element Option of the list Options is neither a variable nor a compound term:
type_error(compound,Option)
An element Option of the list Options is a compound term but not a valid option:
domain_error(option,Option)

decrypt/4

Authenticates and decrypts a v4.local claims token using a key or key set.

Compilation flags:
static
Template:
decrypt(Token,KeyOrKeySet,Claims,Options)
Mode and number of proofs:
decrypt(+atom,+term,-term,+list(compound)) - zero_or_one_or_error
Exceptions:
Token is not a canonical v4.local token:
domain_error(paseto_v4_token,Token)
KeyOrKeySet is an invalid key set:
domain_error(paseto_key_set,KeyOrKeySet)
No key can be selected from KeyOrKeySet:
existence_error(paseto_key,local-KeyId)
The authenticated payload is not a JSON object:
domain_error(paseto_json_object,Claims)
The claims do not satisfy the validation policy:
domain_error(paseto_claims,Reason)
Options is a variable:
instantiation_error
Options is neither a variable nor a list:
type_error(list,Options)
An element Option of the list Options is a variable:
instantiation_error
An element Option of the list Options is neither a variable nor a compound term:
type_error(compound,Option)
An element Option of the list Options is a compound term but not a valid option:
domain_error(option,Option)

decrypt/5

Authenticates and decrypts a v4.local claims token and returns its authenticated footer JSON object.

Compilation flags:
static
Template:
decrypt(Token,KeyOrKeySet,Claims,Footer,Options)
Mode and number of proofs:
decrypt(+atom,+term,-term,-term,+list(compound)) - zero_or_one_or_error
Exceptions:
Token is not a canonical v4.local token:
domain_error(paseto_v4_token,Token)
KeyOrKeySet is an invalid key set:
domain_error(paseto_key_set,KeyOrKeySet)
No key can be selected from KeyOrKeySet:
existence_error(paseto_key,local-KeyId)
The authenticated payload or footer is not a JSON object:
domain_error(paseto_json_object,JSON)
The claims do not satisfy the validation policy:
domain_error(paseto_claims,Reason)
Options is a variable:
instantiation_error
Options is neither a variable nor a list:
type_error(list,Options)
An element Option of the list Options is a variable:
instantiation_error
An element Option of the list Options is neither a variable nor a compound term:
type_error(compound,Option)
An element Option of the list Options is a compound term but not a valid option:
domain_error(option,Option)

sign/4

Signs a JSON claims object as a v4.public token using an Ed25519 seed.

Compilation flags:
static
Template:
sign(Claims,Seed,Token,Options)
Mode and number of proofs:
sign(+term,+list(byte),-atom,+list(compound)) - one_or_error
Exceptions:
Claims is not a JSON object or contains duplicate members:
domain_error(paseto_json_object,Claims)
Seed is not a list of 32 bytes:
type_error(list(byte,32),Seed)
The footer kid conflicts with the key_id/1 option:
domain_error(paseto_footer_key_id,Existing-KeyId)
Options is a variable:
instantiation_error
Options is neither a variable nor a list:
type_error(list,Options)
An element Option of the list Options is a variable:
instantiation_error
An element Option of the list Options is neither a variable nor a compound term:
type_error(compound,Option)
An element Option of the list Options is a compound term but not a valid option:
domain_error(option,Option)

verify/4

Authenticates and validates a v4.public claims token using a public key or key set.

Compilation flags:
static
Template:
verify(Token,KeyOrKeySet,Claims,Options)
Mode and number of proofs:
verify(+atom,+term,-term,+list(compound)) - zero_or_one_or_error
Exceptions:
Token is not a canonical v4.public token:
domain_error(paseto_v4_token,Token)
KeyOrKeySet is an invalid key set:
domain_error(paseto_key_set,KeyOrKeySet)
No key can be selected from KeyOrKeySet:
existence_error(paseto_key,(public-KeyId))
The authenticated payload is not a JSON object:
domain_error(paseto_json_object,Claims)
The claims do not satisfy the validation policy:
domain_error(paseto_claims,Reason)
Options is a variable:
instantiation_error
Options is neither a variable nor a list:
type_error(list,Options)
An element Option of the list Options is a variable:
instantiation_error
An element Option of the list Options is neither a variable nor a compound term:
type_error(compound,Option)
An element Option of the list Options is a compound term but not a valid option:
domain_error(option,Option)

verify/5

Authenticates and validates a v4.public claims token and returns its authenticated footer JSON object.

Compilation flags:
static
Template:
verify(Token,KeyOrKeySet,Claims,Footer,Options)
Mode and number of proofs:
verify(+atom,+term,-term,-term,+list(compound)) - zero_or_one_or_error
Exceptions:
Token is not a canonical v4.public token:
domain_error(paseto_v4_token,Token)
KeyOrKeySet is an invalid key set:
domain_error(paseto_key_set,KeyOrKeySet)
No key can be selected from KeyOrKeySet:
existence_error(paseto_key,(public-KeyId))
The authenticated payload or footer is not a JSON object:
domain_error(paseto_json_object,JSON)
The claims do not satisfy the validation policy:
domain_error(paseto_claims,Reason)
Options is a variable:
instantiation_error
Options is neither a variable nor a list:
type_error(list,Options)
An element Option of the list Options is a variable:
instantiation_error
An element Option of the list Options is neither a variable nor a compound term:
type_error(compound,Option)
An element Option of the list Options is a compound term but not a valid option:
domain_error(option,Option)

claims/2

Decodes claims from a v4.public token without authenticating them. Rejects local tokens. The result must not be trusted.

Compilation flags:
static
Template:
claims(Token,Claims)
Mode and number of proofs:
claims(+atom,-term) - one_or_error
Exceptions:
Token is a variable:
instantiation_error
Token is neither a variable nor an atom:
type_error(atom,Token)
Token is not a canonical v4.public token:
domain_error(paseto_v4_token,Token)
Token has a malformed public payload:
domain_error(paseto_v4_public_payload,Token)
Token payload is not a JSON object:
domain_error(paseto_json_object,Claims)

claim/3

Looks up a value in a claims object.

Compilation flags:
static
Template:
claim(Claims,Name,Value)
Mode and number of proofs:
claim(+term,+atom,-term) - zero_or_one

validate_claims/3

Validates a claims object using a policy list and options.

Compilation flags:
static
Template:
validate_claims(Claims,Policy,Options)
Mode and number of proofs:
validate_claims(+term,+list(compound),+list(compound)) - one_or_error
Exceptions:
Claims is not a JSON object or contains duplicate members:
domain_error(paseto_json_object,Claims)
Claims is missing a required claim Name:
domain_error(paseto_claims,missing(Name))
Policy contains an invalid claim policy:
domain_error(paseto_claim_policy,ClaimPolicy)
A time claim has a non-numeric value:
type_error(time_number,Name-Value)
Options is a variable:
instantiation_error
Options is neither a variable nor a list:
type_error(list,Options)
An element Option of the list Options is a variable:
instantiation_error
An element Option of the list Options is neither a variable nor a compound term:
type_error(compound,Option)
An element Option of the list Options is a compound term but not a valid option:
domain_error(option,Option)

validate_claim/3

Validates one claim policy.

Compilation flags:
static
Template:
validate_claim(Claims,ClaimPolicy,Options)
Meta-predicate template:
validate_claim(*,*,*)
Mode and number of proofs:
validate_claim(+term,+compound,+list(compound)) - one_or_error
Exceptions:
Claims is missing the required claim Name:
domain_error(paseto_claims,missing(Name))
The value of claim Name does not satisfy the policy:
domain_error(paseto_claim(Name),Value)
ClaimPolicy is not a supported claim policy:
domain_error(paseto_claim_policy,ClaimPolicy)
A time claim has an unknown validation kind:
domain_error(paseto_time_claim_kind,Kind)
A time claim has a non-numeric value:
type_error(time_number,Name-Value)
Options is a variable:
instantiation_error
Options is neither a variable nor a list:
type_error(list,Options)
An element Option of the list Options is a variable:
instantiation_error
An element Option of the list Options is neither a variable nor a compound term:
type_error(compound,Option)
An element Option of the list Options is a compound term but not a valid option:
domain_error(option,Option)

peek_key_id/2

Reads a kid value from the unauthenticated token footer for key selection. The result must not be trusted.

Compilation flags:
static
Template:
peek_key_id(Token,KeyId)
Mode and number of proofs:
peek_key_id(+atom,-atom) - zero_or_one_or_error
Exceptions:
Token is a variable:
instantiation_error
Token is neither a variable nor an atom:
type_error(atom,Token)
Token is not a canonical v4 token:
domain_error(paseto_v4_token,Token)
Token footer is not a JSON object:
domain_error(paseto_json_object,Footer)

validate_key_set/1

Validates a native PASETO key_set/1 term.

Compilation flags:
static
Template:
validate_key_set(KeySet)
Mode and number of proofs:
validate_key_set(+compound) - one_or_error
Exceptions:
KeySet is not a valid key_set/1 term:
domain_error(paseto_key_set,KeySet)
KeySet contains an invalid key record Record:
domain_error(paseto_key_record,Record)

Protected predicates

(no local declarations; see entity ancestors if any)

Private predicates

(no local declarations; see entity ancestors if any)

Operators

(none)