Stateless authentication smoother than a fresh groomed trail at Keystone
Real Slack message from HighPlainsHealthcare: "Our mobile app logs out nurses mid-shift. They're using expired tokens and patient data isn't syncing. We need a fix NOW."
That's what happens when JWT tokens are just thrown at the problem without proper expiration handling.
Asymmetric signing with public/private key pairs. No shared secrets to leak.
Configurable lifetimes with automatic refresh. Long-lived sessions without security risks.
Custom claims for roles, permissions, tenant context. Everything your app needs.
// Request JWT with claims
const token = await auth.login({
email: "sarah@denverdesign.com",
password: password,
claims: {
role: "admin",
tenant: "denver-design",
permissions: ["read", "write", "delete"]
}
});
// {
// access_token: "eyJhbGciOiJSUzI1NiIs...",
// token_type: "Bearer",
// expires_in: 3600,
// refresh_token: "rt_secure_refresh_token"
// }// In your API middleware
const jwt = require('jsonwebtoken');
const { getPublicKey } = require('@23blocks/auth-sdk');
const verifyToken = async (req, res, next) => {
const token = req.headers.authorization?.split(' ')[1];
try {
const publicKey = await getPublicKey();
const decoded = jwt.verify(token, publicKey, {
algorithms: ['RS256']
});
req.user = decoded;
next();
} catch (error) {
res.status(401).json({ error: 'Invalid token' });
}
};// Access user data from token
const handleProtectedRoute = (req, res) => {
const { user } = req;
// Token contains everything you need
console.log(user.email); // sarah@denverdesign.com
console.log(user.role); // admin
console.log(user.tenant); // denver-design
console.log(user.permissions); // ["read", "write", "delete"]
// No database lookup needed!
res.json({ message: `Welcome ${user.email}` });
};Stop debugging auth issues. Start delivering fast, secure, stateless authentication.
P.S. Our JWT implementation is like a perfectly tuned ski binding – holds securely when you need it, releases cleanly when you don't.
P.P.S. We've signed more JWT tokens than there are snowflakes in a Vail blizzard. Over 50 billion secure, stateless authentications and counting.
Get product updates, engineering posts, and new block announcements delivered to your inbox.