TokenSmith
JSON Web Tokens for Blueprint and C++

Overview

TokenSmith implements JSON Web Tokens (JWT, RFC 7519) for Unreal Engine 4.27 and 5.8. Use it to issue session tokens on a dedicated server, to check tokens your backend hands to clients, or to read the claims of a token your login service returned.

• Generate signed tokens with your own payload and header claims, an optional issued-at claim, not-before and expiry times.
• Registered claims: type (typ), content type (cty), key id (kid), subject, audience and token id.
• Verify the signature plus issuer, subject, audience, token id and any custom claim, with a clock-skew leeway.
• Read every payload claim of a token into a String-to-String map.
• HMAC (HS256, HS384, HS512) with a shared secret and RSA (RS256, RS384, RS512) with PEM keys.
• 17 Blueprint nodes on the UTokenSmithSubsystem engine subsystem, plus a C++ API.
• Uses the engine’s own OpenSSL; no network access, no external services.

Requirements

Installation

1. Copy the TokenSmith folder into your project’s Plugins folder (or install it to the engine from Fab).
2. Open the project; C++ projects build the plugin modules on the first start.
3. Enable TokenSmith in Edit > Plugins and restart the editor.
4. C++ only: add "TokenSmith", "TokenSmithGenerator" and "TokenSmithVerifier" to your module’s dependencies and set bEnableExceptions = true; in that module’s Build.cs — the public headers include the JWT library, which reports errors with C++ exceptions.

Quick start

Blueprint

1. Place the TokenSmith Subsystem getter (search for TokenSmith Subsystem; it is an engine subsystem and works in any Blueprint).
2. Call Initialize JWT Generator with your secret and HS256.
3. Call Generate Signed JWT: tick IATClaim, fill Claims (for example role → admin), leave Not Before Sec at 0 and Expire After Sec at 900. The return value is the token.
4. Call Initialize JWT Verifier with the same secret and HS256, then Verify JWT with the token: it returns true.
5. Call Get Claims to read the payload as a map.

C++

// MyModule.Build.cs:
// PrivateDependencyModuleNames.AddRange(new string[] { "TokenSmith", "TokenSmithGenerator", "TokenSmithVerifier" });
// bEnableExceptions = true;
#include "TokenSmithSubsystem.h"
#include "Engine/Engine.h"

void IssueAndCheckToken()
{
    UTokenSmithSubsystem* Tokens = GEngine->GetEngineSubsystem<UTokenSmithSubsystem>();

    Tokens->InitGenerator(TEXT("my-shared-secret"), ETokenSmithGeneratorAlgorithm::HS256);
    Tokens->SetSubject(TEXT("player-42"));

    TMap<FString, FString> Claims;
    Claims.Add(TEXT("role"), TEXT("admin"));
    const FString Token = Tokens->GenerateJwtToken(true, Claims, TMap<FString, FString>(), 0, 900);

    Tokens->InitVerifier(TEXT("my-shared-secret"), ETokenSmithVerifierAlgorithm::HS256);
    Tokens->WithSubject(TEXT("player-42"));
    const bool bValid = Tokens->VerifyJWT(Token);

    const TMap<FString, FString> Payload = Tokens->GetClaims(Token);
    UE_LOG(LogTemp, Display, TEXT("Valid: %d, role: %s"), bValid ? 1 : 0, *Payload.FindRef(TEXT("role")));
}

Generator nodes

Category TokenSmith | Generator, on UTokenSmithSubsystem. Settings made with these nodes stay on the shared generator and apply to every token generated afterwards.

Verifier nodes

Category TokenSmith | Verifier, on UTokenSmithSubsystem. Requirements added with the With nodes stay on the shared verifier for the rest of the session.

Algorithms

Keys are passed as text: for HMAC the secret itself, for RSA the complete PEM block including the -----BEGIN ...----- and -----END ...----- lines. Keys, claim names and claim values are handled as UTF-8.

C++ API

Troubleshooting

Credits

© 2026 Alpha XP — alphaxp.net · Support: support@alphaxp.net. Built and verified for Unreal Engine 4.27 and 5.8.