What is jose, and why does Adyen's guide use it?

If you've read Adyen's Card encryption with JWE guide, you'll have seen references to a library called jose.

What it is

jose is an open-source JavaScript library that implements the JOSE family of standards — JSON Web Encryption (JWE), JSON Web Signature (JWS), JSON Web Key (JWK), and related specs. It's not an Adyen product and not a SwipeAras product; it's independent, general-purpose software that happens to implement exactly the cryptographic format Adyen's JWE integration expects.

Adyen's guide names it as an example third-party library — their own wording is that you should use "a third-party JWT library, for example JavaScript Object Signing and Encryption (JOSE)." It's the one their documentation walks through, not the only option. Any library that correctly implements JWE (RFC 7516) with the algorithms Adyen specifies would work the same way, including using a browser's built-in Web Crypto API directly with no library at all.

Where it fits in your code

Two jose functions cover everything Adyen's guide needs:

• importJWK (or importX509, if you're working from a certificate rather than a JWK) — turns a public key into a form the library can encrypt with

• CompactEncrypt — does the actual encryption, producing the JWE string that goes into paymentMethod.encryptedCard

The one thing neither jose nor Adyen's guide covers is turning your Forge Public key string (the 10001|... format) into the JWK that importJWK expects — that's specific to how the key is presented in Forge, not a standard format any general library would recognize. The next article works through that conversion.

Reference

• jose on GitHub

• Adyen: Card encryption with JWE — see "Compute your JWK"