jwk.import / jwk.importPEM

Turn key material (a JWK object, an SPKI / PKCS#8 PEM, an X.509 certificate, or their DER equivalents) into a node:crypto.KeyObject — the shape jws, jwt, and jwe will expect downstream.

import { jwk } from '@exortek/jwk'
 
// JWK → KeyObject
const key = await jwk.import(privateJwk)
 
// PEM → KeyObject
const publicKey  = await jwk.importPEM(spkiPem)                 // 'spki' default
const privateKey = await jwk.importPEM(pkcs8Pem, 'pkcs8')
const fromCert   = await jwk.importPEM(x509CertPem, 'x509')     // extracts public key

The named exports importJWK and importPEM are single-purpose; the jwk namespace exposes jwk.import as an alias for importJWK.

importJWK(jwk, options?)

Runs validate first, then hands the JWK to createPrivateKey / createPublicKey / createSecretKey per kty.

Everything the JWK carries — kid / use / alg / key_ops — is already validated. Node ignores JWK metadata during import; retain the JWK itself if you need those fields later.

importPEM(pemOrDer, format='spki')

Explicit format selection — this is the surface for interop with openssl, ssh-keygen, KMS providers, and X.509 certificate authorities.

Input encoding. Strings are treated as PEM; Buffer is treated as DER. The same call handles both.

// PEM string
const key = await jwk.importPEM(spkiPemString)
// DER buffer
const key2 = await jwk.importPEM(derBuffer)

Round-tripping

const spkiPem = await jwk.exportPEM(publicKey)      // 'spki' by default
const back    = await jwk.importPEM(spkiPem)        // 'spki' by default
// back is a fresh KeyObject with equivalent material.

For JWK ↔ JWK trips through a KeyObject, metadata (kid / use / alg) is stripped by Node — pass it back explicitly on exportJWK:

const key = await jwk.import(privateJwk)
const back = await jwk.export(key, {
  kid: privateJwk.kid,
  use: privateJwk.use,
  alg: privateJwk.alg,
})

Errors