pg_session_jwt
pg_session_jwt : Manage authentication sessions using JWTs
Overview
| ID | Extension | Package | Version | Category | License | Language |
|---|---|---|---|---|---|---|
| 7060 | pg_session_jwt | pg_session_jwt | 0.5.0 | SEC | Apache-2.0 | Rust |
| Attribute | Has Binary | Has Library | Need Load | Has DDL | Relocatable | Trusted |
|---|---|---|---|---|---|---|
--s-dt- | No | Yes | No | Yes | no | yes |
| Relationships | |
|---|---|
| Schemas | auth |
| See Also | pgjwt pgaudit pgsodium supabase_vault anon |
Packages
| Type | Repo | Version | PG Major Compatibility | Package Pattern | Dependencies |
|---|---|---|---|---|---|
| EXT | PIGSTY | 0.5.0 | 18 17 16 15 14 | pg_session_jwt | - |
| RPM | PIGSTY | 0.5.0 | 18 17 16 15 14 | pg_session_jwt_$v | - |
| DEB | PIGSTY | 0.5.0 | 18 17 16 15 14 | postgresql-$v-pg-session-jwt | - |
| Linux / PG | PG18 | PG17 | PG16 | PG15 | PG14 |
|---|---|---|---|---|---|
el8.x86_64 | PIGSTY 0.5.0 | PIGSTY 0.5.0 | PIGSTY 0.5.0 | PIGSTY 0.5.0 | PIGSTY 0.5.0 |
el8.aarch64 | PIGSTY 0.5.0 | PIGSTY 0.5.0 | PIGSTY 0.5.0 | PIGSTY 0.5.0 | PIGSTY 0.5.0 |
el9.x86_64 | PIGSTY 0.5.0 | PIGSTY 0.5.0 | PIGSTY 0.5.0 | PIGSTY 0.5.0 | PIGSTY 0.5.0 |
el9.aarch64 | PIGSTY 0.5.0 | PIGSTY 0.5.0 | PIGSTY 0.5.0 | PIGSTY 0.5.0 | PIGSTY 0.5.0 |
el10.x86_64 | PIGSTY 0.5.0 | PIGSTY 0.5.0 | PIGSTY 0.5.0 | PIGSTY 0.5.0 | PIGSTY 0.5.0 |
el10.aarch64 | PIGSTY 0.5.0 | PIGSTY 0.5.0 | PIGSTY 0.5.0 | PIGSTY 0.5.0 | PIGSTY 0.5.0 |
d12.x86_64 | PIGSTY 0.5.0 | PIGSTY 0.5.0 | PIGSTY 0.5.0 | PIGSTY 0.5.0 | PIGSTY 0.5.0 |
d12.aarch64 | PIGSTY 0.5.0 | PIGSTY 0.5.0 | PIGSTY 0.5.0 | PIGSTY 0.5.0 | PIGSTY 0.5.0 |
d13.x86_64 | PIGSTY 0.5.0 | PIGSTY 0.5.0 | PIGSTY 0.5.0 | PIGSTY 0.5.0 | PIGSTY 0.5.0 |
d13.aarch64 | PIGSTY 0.5.0 | PIGSTY 0.5.0 | PIGSTY 0.5.0 | PIGSTY 0.5.0 | PIGSTY 0.5.0 |
u22.x86_64 | PIGSTY 0.5.0 | PIGSTY 0.5.0 | PIGSTY 0.5.0 | PIGSTY 0.5.0 | PIGSTY 0.5.0 |
u22.aarch64 | PIGSTY 0.5.0 | PIGSTY 0.5.0 | PIGSTY 0.5.0 | PIGSTY 0.5.0 | PIGSTY 0.5.0 |
u24.x86_64 | PIGSTY 0.5.0 | PIGSTY 0.5.0 | PIGSTY 0.5.0 | PIGSTY 0.5.0 | PIGSTY 0.5.0 |
u24.aarch64 | PIGSTY 0.5.0 | PIGSTY 0.5.0 | PIGSTY 0.5.0 | PIGSTY 0.5.0 | PIGSTY 0.5.0 |
u26.x86_64 | PIGSTY 0.5.0 | PIGSTY 0.5.0 | PIGSTY 0.5.0 | PIGSTY 0.5.0 | PIGSTY 0.5.0 |
u26.aarch64 | PIGSTY 0.5.0 | PIGSTY 0.5.0 | PIGSTY 0.5.0 | PIGSTY 0.5.0 | PIGSTY 0.5.0 |
Source
pig build pkg pg_session_jwt; # build rpm/debInstall
Make sure PGDG and PIGSTY repo available:
pig repo add pgsql -u # add both repo and update cacheInstall this extension with pig:
pig install pg_session_jwt; # install via package name, for the active PG version
pig install pg_session_jwt -v 18; # install for PG 18
pig install pg_session_jwt -v 17; # install for PG 17
pig install pg_session_jwt -v 16; # install for PG 16
pig install pg_session_jwt -v 15; # install for PG 15
pig install pg_session_jwt -v 14; # install for PG 14Create this extension with:
CREATE EXTENSION pg_session_jwt;Usage
Sources: README, v0.5.0 tag, control file
pg_session_jwt handles authenticated sessions through JWTs. When configured with a JWK, it verifies JWT authenticity. Without a JWK, it falls back to PostgREST-compatible request.jwt.claims.
CREATE EXTENSION pg_session_jwt;Mode 1: JWK Validation
Set the JWK at connection time via libpq options:
export PGOPTIONS="-c pg_session_jwt.jwk=$MY_JWK"Then within the session:
SELECT auth.init(); -- Initialize with JWK
SELECT auth.jwt_session_init('eyJ...'); -- Set and validate the JWT
SELECT auth.user_id(); -- Get the 'sub' claim
SELECT auth.session(); -- Get full JWT payload as JSONBMode 2: PostgREST-Compatible (No JWK)
Works out of the box with PostgREST. No initialization needed:
SELECT auth.user_id(); -- Returns 'sub' from request.jwt.claims
SELECT auth.session(); -- Returns full claims as JSONBFunctions
| Function | Returns | Description |
|---|---|---|
auth.init() | void | Initialize session using JWK |
auth.jwt_session_init(jwt text) | void | Set and validate a JWT |
auth.session() | jsonb | Get JWT payload or fallback claims |
auth.jwt() | jsonb | Alias for auth.session() |
auth.user_id() | text | Get the sub claim |
auth.uid() | uuid | Get sub as UUID (or NULL) |
auth.organization() | jsonb | Neon Auth organization claim helper |
auth.organization_id() | uuid | Neon Auth organization id helper |
Configuration
| Parameter | Description |
|---|---|
pg_session_jwt.jwk | JWK for JWT validation (set at startup or connection) |
pg_session_jwt.audit_log | Enable audit logging (on/off) |
RLS Example
CREATE POLICY user_isolation ON my_table
USING (user_id = auth.user_id());For Neon Auth organization-scoped policies, use the o claim helpers:
CREATE POLICY team_select ON team
FOR SELECT
USING (organization_id = auth.organization_id());Version Notes
The v0.5.0 README adds Neon Auth organization helpers and explicitly separates portable helpers such as auth.jwt(), auth.user_id(), and auth.uid() from Neon-specific auth.organization() and auth.organization_id(). Other auth providers should use auth.jwt() and extract provider-specific claims directly.