Docs / Getting started

Validate your first token.

AuthLint runs locally. It does not need an account, hosted service, or application framework integration.

Install

Download an archive for your operating system from the latest GitHub release, verify it with checksums.txt, and place the authlint binary on your PATH.

build from sourcesh

go build -o bin/authlint ./cmd/authlint
bin/authlint --version

Write a policy

You need a JWT, the provider's public JWKS document, and an AuthLint JSON policy. Never provide a private signing key.

authlint.jsonjson

{
  "issuer": "https://issuer.example.com/",
  "audiences": ["my-api"],
  "jwks_file": "./jwks.json",
  "allowed_algorithms": ["RS256", "ES256"],
  "required": {"exp": true, "iss": true, "aud": true},
  "clock_skew_seconds": 30
}

Run the check

terminalsh

bin/authlint --token-file ./token.jwt --config ./authlint.json

# For CI and other automation
bin/authlint --token "$JWT" --config ./authlint.json --json

Exit codes

Exit codes are stable for CI: 0 means success, 1 warnings, 2 validation failures, and 3 invalid configuration or runtime errors.

Do not commit tokens, private keys, or credentials to a repository. AuthLint does not print the token or key material.