Method Jwt

java/lib/src/main/java/io/github/ccxt/base/Crypto.java:220–270

(Object data, Object secret, Object hash, boolean isRsa, Object options2)

    // ====================================================

    public static String Jwt(Object data, Object secret, Object hash, boolean isRsa, Object options2) {
        Map<String, Object> options = (options2 instanceof Map) ? (Map<String, Object>) options2 : new LinkedHashMap<>();
        String algorithm = (hash == null) ? null : toString(hash); // e.g., "sha256", "sha384", "sha512"
        if (algorithm == null) throw new IllegalArgumentException("JWT requires hash algorithm name");

        String alg = (isRsa ? "RS" : "HS") + algorithm.substring(3).toUpperCase(Locale.ROOT);
        if (options.containsKey("alg")) {
            alg = toString(options.get("alg"));
        }

        Map<String, Object> header = new LinkedHashMap<>();
        header.put("alg", alg);
        header.put("typ", "JWT");
        header.putAll(options);

        // Move iat from header to payload if present (to mimic C# logic)
        if (header.containsKey("iat") && data instanceof Map<?, ?>) {
            ((Map<String, Object>) data).put("iat", header.get("iat"));
            header.remove("iat");
        }

        String encodedHeader = Base64urlEncode(json(header));
        String encodedPayload = Base64urlEncode(json(data));
        String token = encodedHeader + "." + encodedPayload;

        String algoType = alg.substring(0, 2); // HS / RS / ES / Ed
        String signatureB64Url;

        if (isRsa) {
            // RSxxx with private key PEM
            byte[] sig = rsaSign(token, toString(secret), algorithm);
            signatureB64Url = Base64ToBase64Url(BinaryToBase64(sig), true);
        } else if ("ES".equals(algoType)) {
            // ES256: sign over P-256 -> r||s then base64url
            byte[] rs = es256Sign(token, toString(secret));
            signatureB64Url = Base64ToBase64Url(BinaryToBase64(rs), true);
        } else if ("Ed".equals(algoType)) {
            // Ed25519
            String base64Sig = toString(Eddsa(token, secret, ed25519()));
            signatureB64Url = Base64ToBase64Url(base64Sig, true);
        } else {
            // HMAC HS256/384/512
            String bin = toString(Hmac(token, secret, algorithm, "binary"));
            // Hmac(...,"binary") above returns byte[] in C#, here we returned hex/base64.
            // So call Hmac again but fetch raw bytes:
            byte[] sig = hmacRaw(alg, token, secret);
            signatureB64Url = Base64ToBase64Url(BinaryToBase64(sig), true);
        }

        return token + "." + signatureB64Url;
    }

    private static byte[] hmacRaw(String hsName, String data, Object secret) {
        // hsName = HS256/HS384/HS512