Configuration

Last updated 2026-10-21

Every setting passes through goJwt.New(goJwt.Config{...}); the library reads no environment variables. Key settings are covered in Key Management.

Config

Field	Type	JSON tag	Required	Description
`Redis`	`Redis`	`redis`	Yes	Redis connection settings
`File`	`*File`	`file`	No	PEM key file paths
`Option`	`*Option`	`parameter`	No	Token parameters; `nil` applies every default
`Cookie`	`*Cookie`	`cookie`	No	Cookie attribute overrides; `nil` keeps the defaults
`CheckAuth`	`func(Auth) (bool, error)`	not serialized	No	Called on every refresh; returning `false` or an error rejects the refresh (see Transparent Refresh)

The JSON tag of Option is parameter; use that key when loading the config from JSON.

Redis

Field	Type	Description
`Host`	`string`	Host address
`Port`	`int`	Port
`Password`	`string`	Password, optional
`DB`	`int`	Database index

New() builds a go-redis client for Host:Port with Password and DB, then sends PING; a failed PING makes New() return an error.

Option

Field	Type	Default	Description
`PrivateKey`	`string`	—	ECDSA private key PEM
`PublicKey`	`string`	—	ECDSA public key PEM
`AccessTokenExpires`	`time.Duration`	`15 * time.Minute`	Lifetime of the Access Token and its JTI
`RefreshIdExpires`	`time.Duration`	`7 * 24 * time.Hour`	Refresh ID lifetime
`AccessTokenCookieKey`	`string`	`access_token`	Access Token cookie name
`RefreshIdCookieKey`	`string`	`refresh_id`	Refresh ID cookie name; also the JWT claim name holding the Refresh ID
`MaxVersion`	`int`	`5`	Maximum re-sign-only refreshes before a full reissue
`RefreshTTL`	`float64`	`0.5`	Full reissue once the Refresh ID's remaining TTL drops below `RefreshIdExpires × RefreshTTL`

Zero or negative values fall back to the defaults. Verify() reads the Refresh ID claim under the current RefreshIdCookieKey with an unchecked type assertion, so after changing it, a still-valid Access Token issued under the old name panics inside Verify() (under gin.Default() the recovery middleware answers 500; a plain net/http server aborts that request). Change it together with a key rotation, or wait until every Access Token issued under the old name has expired.

Field	Type	Default
`Domain`	`*string`	unset (host-only)
`Path`	`*string`	`/`
`SameSite`	`*http.SameSite`	`http.SameSiteLaxMode`
`Secure`	`*bool`	`false`
`HttpOnly`	`*bool`	`true`

Only non-nil fields override the defaults; they apply to the access_token, refresh_id, and conn.device.id cookies.

Full Example

package main
import (
	"log"
	"net/http"
	"time"
	goJwt "github.com/pardnchiu/go-jwt/core"
)
func main() {
	domain := "example.com"
	secure := true
	sameSite := http.SameSiteStrictMode
	auth, err := goJwt.New(goJwt.Config{
		Redis: goJwt.Redis{Host: "redis.internal", Port: 6379, Password: "secret", DB: 1},
		File: &goJwt.File{
			PrivateKeyPath: "/etc/app/keys/private-key.pem",
			PublicKeyPath:  "/etc/app/keys/public-key.pem",
		},
		Option: &goJwt.Option{
			AccessTokenExpires: 10 * time.Minute,
			RefreshIdExpires:   30 * 24 * time.Hour,
			MaxVersion:         10,
			RefreshTTL:         0.3,
		},
		Cookie: &goJwt.Cookie{
			Domain:   &domain,
			Secure:   &secure,
			SameSite: &sameSite,
		},
	})
	if err != nil {
		log.Fatalf("failed to init go-jwt: %v", err)
	}
	defer auth.Close()
}

Logging

New() points the package-level slog logger to syslog (priority LOG_INFO|LOG_LOCAL0, tag goCron, JSON format) and falls back to stderr (text format) when syslog is unreachable. Filter syslog by the goCron tag to find go-jwt entries.