v0.2.0

The library grew from a JWT string type into a way to declare tokens as models.
0.1.1 shipped JWTStr and JWTConstraints; everything else here is new.

Full documentation: [pydantic-jwt.dmi03.com](https://pydantic-jwt.dmi03.com)

from pydantic_jwt import ConfigDict, Exp, JWTModel, after, uuid


class AccessToken(JWTModel):
    model_config = ConfigDict(
        algorithm="HS256",
        encoding_key=SECRET,
        decoding_key=SECRET,
    )

    sub: str
    exp: Exp = after(minutes=15)
    jti: str = uuid()


raw = str(AccessToken(sub="user-42"))  # issue
token = AccessToken.from_token(raw)  # read back, verified

Added

• JWTModel — a Pydantic model that is also a JWT. One class issues tokens
  (generate(), str(), .jwt_str) and validates incoming ones
  (from_token(), or by validating a token string into the field), with the
  signature verified through PyJWT. The algorithm comes from your configuration
  and never from the token header, so a forged alg cannot influence
  verification.
• Claim markers — Exp, Nbf and Iat validate against the current clock
  (with an optional leeway for clock skew); IssClaim and AudClaim validate
  against an expected issuer and audience. All are plain Annotated metadata,
  so they compose with anything else Pydantic can do to a field, and Claim can
  be subclassed for your own.
• Field defaults — after(), at() and uuid() for exp, nbf and
  jti, evaluated per instance so every token gets fresh values.
• ConfigDict — Pydantic's config extended with algorithm,
  encoding_key, decoding_key and require_keys.
• Per-call keys — from_token() accepts decoding_key, algorithm and
  require_keys overriding the config, and reads the same values from the
  validation context, for keys that are only known at request time.
• OpenAPI support — a token model reports itself as
  {"type": "string", "format": "jwt"} with its claims listed in the
  description.
• Documentation site — guides, a full API reference,
  [security notes](https://pydantic-jwt.dmi03.com/guide/security/) and a
  complete [FastAPI example](https://pydantic-jwt.dmi03.com/integrations/fastapi/)
  with bearer authentication, refresh tokens and scopes.

Removed

• JWTConstraints. Constraints are now expressed as claim markers on a
  JWTModel field, which validate the parsed claim instead of the raw string.
  JWTStr is unchanged and still does structural validation only.

Fixed

• The validation context is now forwarded through from_token(), so
  context={"validate_claims": False} works for tokens validated from a token
  string and not only from a dict.

Requirements

Python 3.10+, Pydantic 2.10+, PyJWT.

pip install pydantic-jwt