@Theory
  public void multipleKeysReadKeysetComputeVerifyJwtMac_success()
      throws Exception {
    KeysetHandle handle =
        TinkJsonProtoKeysetFormat.parseKeyset(
            JSON_JWT_MAC_KEYSET_WITH_MULTIPLE_KEYS, InsecureSecretKeyAccess.get());
    Instant now = Clock.systemUTC().instant();
    JwtMac jwtMac = handle.getPrimitive(JwtMac.class);
    RawJwt rawJwt =
        RawJwt.newBuilder()
            .setIssuer("issuer")
            .addAudience("audience")
            .setSubject("subject")
            .setExpiration(now.plusSeconds(100))
            .build();
    String token = jwtMac.computeMacAndEncode(rawJwt);
    JwtValidator validator =
        JwtValidator.newBuilder().expectIssuer("issuer").expectAudience("audience").build();
    VerifiedJwt verifiedJwt = jwtMac.verifyMacAndDecode(token, validator);
    assertThat(verifiedJwt.getSubject()).isEqualTo("subject");

    // Also test that jwtMac can verify tokens computed with a non-primary key. We use
    // JSON_JWT_MAC_KEYSET to compute a tag with the first key.
    KeysetHandle handle1 =
        TinkJsonProtoKeysetFormat.parseKeyset(
            JSON_JWT_MAC_KEYSET, InsecureSecretKeyAccess.get());
    JwtMac jwtMac1 = handle1.getPrimitive(JwtMac.class);
    String token1 = jwtMac1.computeMacAndEncode(rawJwt);
    assertThat(jwtMac.verifyMacAndDecode(token1, validator).getSubject()).isEqualTo("subject");
  }
Unit tests for the jwt package. Uses only the public API.
java_src/src/test/java/com/google/crypto/tink/jwt/JwtTest.java