TokenSmith
Create, sign and verify JSON Web Tokens and read their claims from Blueprints or C++, with HMAC (HS256/384/512) and RSA (RS256/384/512) signing.
Highlights
All 10 features →TokenSmith brings JSON Web Tokens (JWT) to Unreal Engine. Initialize a generator with a secret or an RSA private key, add your claims and call Generate Signed JWT to get a signed token with issued-at, not-before and expiry times. On the other side, initialize a verifier with the matching key, add requirements such as issuer, subject, audience or any custom claim, and Verify JWT tells you whether the token is genuine and still valid.
Everything lives on an engine subsystem, so the same 17 Blueprint nodes and C++ functions work in the editor, in packaged games and on dedicated servers. Get Claims reads every payload claim of a token into a string map for your gameplay or UI code.
Typical uses: a dedicated server that issues short-lived session tokens, a client or server that checks tokens issued by your backend or login service, signed invitation or reward codes, and tools that need to inspect a token's claims.
TokenSmith is part of the Alpha XP utilities collection for Unreal Engine 4.27 and 5.8. Every feature is exposed to Blueprints and C++, it ships with styled HTML documentation, and it is compiled and verified warning-free against clean UE 4.27 and UE 5.8 projects.
Key features
- Generate Signed JWT with payload claims, header claims, issued-at, not-before and expiry
- Set Type, Set Content Type, Set Key ID, Set Subject, Set Audience and Set ID for
- Verify JWT checks signature, algorithm and time window, with the failure reason in the log
- Verification requirements: With Issuer, With Subject, With Audience, With ID, With
- With Leeway for clock differences between machines
- Get Claims returns all payload claims as a string map
- HS256, HS384, HS512 with shared secrets; RS256, RS384, RS512 with PEM keys
- UTF-8 claims and keys
- Engine subsystem: available in editor, game and dedicated server
- Uses the engine's OpenSSL; no network access and no external services
Blueprint & C++ API
Callable runs when executed · Pure no exec pin, returns a value
Verifier 9
| Node | Type |
|---|---|
| Initialize JWT Verifier(Key: String, Algorithm: Token Smith Verifier Algorithm) | Callable |
| With Issuer(Issuer: String) → //iss void | Callable |
| With Subject(Subject: String) → //sub void | Callable |
| With Audience(Audience: String) → //aud void | Callable |
| With Leeway(Leeway: Integer) | Callable |
| With ID(ID: String) → //jti void | Callable |
| With Custom Claim(Name: String, Value: String) | Callable |
| Verify JWT(Input: String) → Boolean | Callable |
| Get Claims(JWT Token: String) → Map String → String | Callable |
Generator 8
| Node | Type |
|---|---|
| Initialize JWT Generator(Key: String, Algorithm: Token Smith Generator Algorithm) | Callable |
| Set Type(Type: String) → //typ void | Callable |
| Set Content Type(Content Type: String) → //cty void | Callable |
| Set Key ID(Key ID: String) → //kid void | Callable |
| Set Subject(Subject: String) → //sub void | Callable |
| Set Audience(Audience: String) → //aud void | Callable |
| Set ID(ID: String) → //jti void | Callable |
| Generate Signed JWT(IAT Claim: Boolean, Claims: Map String → String, Header Claims: Map String → String, Not Before Sec: Integer, Expire After Sec: Integer) → String | Callable |
Options & enums
| Enum | Values |
|---|---|
| Generator Algorithm | HS256 HS384 HS512 RS256 RS384 RS512 |
| Verifier Algorithm | HS256 HS384 HS512 RS256 RS384 RS512 |
Compatibility
One ready-made build per engine version is included in the download — copy the one that matches your project.
| Platform | Supported in |
|---|---|
| Windows | Editor & packaged |
| Linux | Editor & packaged |
| Linux ARM64 | Packaged builds |
| Module | Type | Loading phase |
|---|---|---|
| TokenSmith | Runtime | PreLoadingScreen |
| TokenSmithVerifier | Runtime | PreLoadingScreen |
| TokenSmithGenerator | Runtime | PreLoadingScreen |
Technical details
| Code modules | TokenSmith (Runtime), TokenSmithVerifier (Runtime), TokenSmithGenerator (Runtime) |
|---|---|
| Blueprints | 0 · C++ classes: 1 |
| Network replicated | No |
| Development platforms | Windows: Yes, Mac: No |
| Target build platforms | Win64, Linux, LinuxAArch64 (LinuxArm64 on UE 5.8) (Win64 verified) |
| Third-party software | Yes |
| Engine versions | Unreal Engine 4.27 · 5.8 — a build for each is included |
| C++ classes | 1 |
| Blueprint nodes | 17 |
| Documentation | Documentation.html (in the download) |
| Download | TokenSmith.zip · 147 KB |
| Version | v1.0.0 |
Third-party components
- jwt-cpp (0.6 series, header-only), Copyright (c) 2018 Dominik Thalhammer, MIT License
- picojson (header-only), Copyright 2009-2010 Cybozu Labs, Inc. and Copyright 2011-2014 Kazuho Oku, BSD 2-Clause License
Both are shipped as source headers and compiled into the plugin; signing uses the engine's own OpenSSL module, and neither component sends any data to its authors. The full attributions accompany the Third Party Software declaration submitted to Epic.
What's in the download
| File | What it is |
|---|---|
| TokenSmith 4.27.zip | Plugin build for Unreal Engine 4.27 |
| TokenSmith 5.8.zip | Plugin build for Unreal Engine 5.8 |
| Documentation.html | Documentation (open in a browser) |
Quick start
- Unzip the download and pick the build that matches your engine (4.27 · 5.8).
- Copy the TokenSmith folder into your project's Plugins/ folder (create it if needed).
- Open the project, enable TokenSmith under Edit › Plugins and restart the editor.
- Right-click in any Blueprint graph and search Verifier — or include the public headers from C++.
- Package for your target platform (Windows, Linux, Linux ARM64).
Good to know
Built and verified warning-free for Unreal Engine 4.27 and 5.8. C++ modules that include TokenSmith headers must set bEnableExceptions = true in their Build.cs; Linux targets are supported by the code but not verified by Alpha XP. Developed and maintained by Alpha XP.
Everything included
- Generate Signed JWT with payload claims, header claims, issued-at, not-before and expiry
- Set Type, Set Content Type, Set Key ID, Set Subject, Set Audience and Set ID for…
- Verify JWT checks signature, algorithm and time window, with the failure reason in the log
- Verification requirements: With Issuer, With Subject, With Audience, With ID, With…
- With Leeway for clock differences between machines
- Get Claims returns all payload claims as a string map
- HS256, HS384, HS512 with shared secrets; RS256, RS384, RS512 with PEM keys
- UTF-8 claims and keys
- Engine subsystem: available in editor, game and dedicated server
- Uses the engine's OpenSSL; no network access and no external services
Platforms
Requirements
- Unreal Engine 4.27 and 5.8
- Develop on Windows (Win64)
- Blueprints and C++
In the download
Personal
One non-commercial project
- 1 activation seat
- 1 year of updates
- One end product
- Non-commercial use
- Community support
- 14-day refund window
Commercial
Ship paid products
- 5 activation seats
- 1 year of updates
- One paid end product
- Unlimited end users
- Priority support
- Source files
- 14-day refund window
Extended
Resell & white-label
- Unlimited activation seats
- Lifetime updates
- Unlimited end products
- White-label & resell
- 1-hour SLA
- Seat-free team use
- 14-day refund window
One purchase per product, no subscription. Each licence comes with a signed key — 1 seat on Personal, 5 seats on Commercial, unlimited seats on Extended. Paid licences can be refunded within 14 days from your order page.
- v1.0.0Latest
- Unreal Engine 4.27 and 5.8
- Blueprint and C++ API, HTML documentation
Be the first to review TokenSmith — reviews come from customers who bought it, so every one is a verified purchase.
Frequently asked
How do I get the files after paying?
Straight after checkout you land on your order page with the download button and your licence key. A receipt is emailed to you, and every order stays in My library.
Which licence do I need?
Personal — One non-commercial project. Commercial — Ship paid products. Extended — Resell & white-label. The Licences tab compares them side by side.
On how many devices can I activate it?
1 seat on Personal, 5 seats on Commercial, unlimited seats on Extended.
How long do I get updates?
Personal: 1 year of updates, Commercial: 1 year of updates, Extended: lifetime updates, counted from your purchase.
Can I get a refund?
Yes — paid licences can be refunded within 14 days, straight from your order page.
Is the download safe?
The file was scanned with ClamAV when it was published. Its SHA-256 checksum is listed under Features → In the download, so you can verify the file you receive.
Do I need an account?
No. Checkout only needs your email. Signing in keeps all your purchases, keys and downloads together in My library.
More like this
AudioLens
Real-time audio analysis: FFT spectrum, onset and beat detection, and a full set of time- and frequency-domain descriptors..
★★★★★ No reviews yetTTechHarbour$14.00BlueprintTCP
BlueprintTCP lets you connect to any TCP server and exchange data entirely from Blueprints — no C++ and no networking boilerplate.
★★★★★ No reviews yetTTechHarbour$12.99BluetoothLink
Bluetooth Low Energy for Unreal - scan, connect, read, write and subscribe to BLE devices on Android and iOS.
★★★★★ No reviews yetTTechHarbour$11.99ClusterLink
SocketCluster realtime client for Unreal - pub/sub channels, auth engine and JSON codec, usable from Blueprints.
★★★★★ No reviews yetTTechHarbour$11.99