Catch identity mistakes before production.
AuthLint is a fast, framework-agnostic CLI that validates JWT security policies locally and in CI—so small identity misconfigurations become actionable feedback, not production incidents.
Make identity policy visible in the terminal.
AuthLint keeps the first feedback loop close to the code. No hosted service, account, or framework integration required.
$ authlint --token-file ./token.jwt --config ./authlint.json
✓ Signature verified
✓ Issuer matched
✓ Audience matched
✗ Missing exp claim
Exit code: 2A small tool with a clear contract.
Secure defaults, actionable diagnostics, and predictable behavior for local development and CI.
Fast Go binary
A focused native CLI that keeps feedback local and quick.
Framework agnostic
Validate the identity policy around any stack or provider.
Actionable findings
Every finding explains what is wrong, why it matters, and how to remediate it.
Human or JSON output
Readable terminal feedback for humans; structured findings for automation.
Stable CI exit codes
0 success, 1 warnings, 2 validation failures, 3 configuration or runtime errors.
Secure defaults
Explicit network behavior and conservative algorithm and clock-skew policies.
The checks that ship today.
AuthLint v0.1 deliberately focuses on validating JWTs and the policy around them.
Start with a token and a policy.
Download a release binary or build AuthLint from source. Your token and key material stay in your environment.
go build -o bin/authlint ./cmd/authlint
bin/authlint --token-file ./token.jwt \
--config ./authlint.jsonFrom JWTs to identity systems.
The roadmap is directional. Adoption, feedback, and security research shape the sequencing.