Implement JWT Signing and Verification

HMAC-signed tokens with expiry

Challenge 3 of Platform EngineeringIntermediate~50 min

Build the stateless auth token that backs modern APIs: base64url encoding, the header.payload signing input, an HMAC-SHA256 signature, verification with a constant-time compare, and expiry (exp) enforcement, so you understand exactly what a JWT is and why a tampered one fails.

5 steps

1. 1Base64url Encoding
2. 2The Signing Input
3. 3Signing with HMAC-SHA256
4. 4Verifying a Token
5. 5Expiry