jwt

This module contains functions and types to encode and decode JWTs issued and used by Auth.js.

The JWT issued by Auth.js is encrypted by default, using the A256GCM algorithm (JWE). It uses the AUTH_SECRET environment variable to derive a sufficient encryption key.

Note

Auth.js JWTs are meant to be used by the same app that issued them. If you need JWT authentication for your third-party API, you should rely on your Identity Provider instead.

Installation

npm

npm install @auth/core

yarn

yarn add @auth/core

pnpm

pnpm add @auth/core

You can then import this submodule from @auth/core/jwt.

Usage

Warning

This module will be refactored/changed. We do not recommend relying on it right now.

Resources

• What is a JWT session strategy
• RFC7519 - JSON Web Token (JWT)

decode()

Decodes a Auth.js issued JWT.

decode<Payload>(params: JWTDecodeParams): Promise<Payload | null>

Type parameters

• Payload = JWT

Parameters

Parameter	Type
params	JWTDecodeParams

Returns

Promise<Payload | null>

---

encode()

Issues a JWT. By default, the JWT is encrypted using "A256GCM".

encode<Payload>(params: JWTEncodeParams<Payload>): Promise<string>

Type parameters

• Payload = JWT

Parameters

Parameter	Type
params	JWTEncodeParams<Payload>

Returns

Promise<string>

---

getToken()

Takes an Auth.js request (req) and returns either the Auth.js issued JWT's payload, or the raw JWT string. We look for the JWT in the either the cookies, or the Authorization header. Documentation

getToken<R>(params: GetTokenParams<R>): Promise<R extends true ? string : JWT | null>

Type parameters

• R extends boolean = false

Parameters

Parameter	Type
params	GetTokenParams<R>

Returns

Promise<R extends true ? string : JWT | null>

---

JWT

Returned by the jwt callback and getToken, when using JWT sessions

jwt callback | getToken

---