> ## Documentation Index
> Fetch the complete documentation index at: https://villagesql.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# vsql_pgjwt extension for MySQL

> The vsql_pgjwt community extension signs, verifies, and decodes JSON Web Tokens inside MySQL, supporting HS256, HS384, HS512, and RS256.

`vsql_pgjwt` signs, verifies, and decodes JSON Web Tokens inside SQL. A stored
function can hand back a signed token, and a query can check one it was given
without calling out to an application.

|                              |                                                                       |
| ---------------------------- | --------------------------------------------------------------------- |
| **Maintainer**               | [Anurag Ojha](https://github.com/intojhanurag)                        |
| **Source and documentation** | [intojhanurag/vsql-pgjwt](https://github.com/intojhanurag/vsql-pgjwt) |
| **License**                  | GPL-2.0                                                               |

<Note>
  A third party writes and maintains this extension. VillageSQL does not build,
  test, or ship it, and the description below follows the maintainer's own
  documentation. Read that documentation before you rely on it.
</Note>

## Install

Build it from the repository, then install it into the server:

```sql theme={null}
INSTALL EXTENSION vsql_pgjwt;
```

## What it adds

| Function                               | Returns | What it does                                                                           |
| -------------------------------------- | ------- | -------------------------------------------------------------------------------------- |
| `jwt_sign(payload, secret, algorithm)` | text    | Signs a payload and returns the token                                                  |
| `jwt_verify(token, secret, algorithm)` | text    | Checks the signature and returns a JSON envelope with `valid`, `header`, and `payload` |
| `jwt_decode(token)`                    | text    | Reads a token's contents without checking the signature                                |

HMAC signing is supported as HS256, HS384, and HS512, and RSA as RS256.

<Warning>
  `jwt_decode` does not verify anything. Treat a decoded payload as text
  somebody sent you, not as a fact, until `jwt_verify` has passed on the same
  token.
</Warning>

## See also

* [vsql\_oauth2](/docs/mysql-9.7/dev/extensions/vsql-oauth2) — signing in to the database itself with a JWT, rather than handling tokens in SQL
* [Available extensions](/docs/mysql-9.7/dev/extensions) — the full catalog
* [intojhanurag/vsql-pgjwt](https://github.com/intojhanurag/vsql-pgjwt) — source, examples, error handling, and the known limitations