import * as jose from "jose";
export interface SignConfig {
    /**
     * Expiration for the access token. A pretty common choice is to set the
     * access token lifetime to is one hour.
     */
    expiration: string;
    /**
     * Issuer. The app should set the `iss` claim to the URL of the token endpoint,
     * since it's the token endpoint the one who issues the JWT.
     *
     * Example:
     *
     * ```js
     * const iss = 'https://example.com/token'
     * ```
     *
     * If you follow the OpenID Connect Discovery standard, the iss value should
     * match the URL of your `.well-known/openid-configuration` file (if you have
     * one).
     */
    issuer: string;
    jwks: {
        keys: jose.JWK[];
    };
    /**
     * Key ID that will be used to sign the JWT. It should be a JSON Web Key (JWK)
     * from a JSON Web Key Set (JWKS).
     */
    kid: string;
    payload: jose.JWTPayload;
}
/**
 * Creates a JSON Web Token, signs it, then returns it to the caller.
 *
 * The JWT returned by this function:
 * 1. includes the payload provided by the caller;
 * 2. is signed using the private Key ID (`kid`) found in the JWKS provided;
 * 3. includes, in the protected header, information related to the JWK used to
 * sign the JWT.
 */
export declare const sign: (config: SignConfig) => Promise<{
    error: Error;
    value?: undefined;
} | {
    value: string;
    error?: undefined;
}>;
//# sourceMappingURL=sign-jwt.d.ts.map