Module validator 

Token validation and delegation-chain verification.

Structs

IdentityValidator

The validator: keyed by kid, audience-bound, and optionally issuer-allowlisted (opt in via IdentityValidator::allow_issuers; with no allowlist configured, any issuer is accepted).

ValidatedIdentity

A successfully validated identity.

Enums

IdentityError

Identity validation failures.

KeyMaterial

Verification key material, bound to a kid.

Constants

DEFAULT_LEEWAY_SECS

Clock tolerance shared by inbound and exchanged-token validation.

MAX_IDENTITY_STRING_CHARS

Maximum characters in a rendered identity field or scope.

MAX_SCOPES

Maximum number of scopes carried by a token.