JWT authentication without code: issue and verify tokens

In nana800 a JWT token is issued and checked by two blocks without code: one signs the token with a secret key, the other checks the signature and the expiry. This adds token login to your own webhook API, just like on a regular server. Issuing or checking a token costs $0.001, and your balance is topped up to $3.50 for free every month.

Build it in the builder
  • Block run: $0.001
  • Free every month: $3.50
  • No card needed

What you can do

  • Return a token in the answer to a request, for example after checking a login in your database
  • Protect webhooks from strangers: the scheme does its work only if the token from the request passes the check
  • Set the token lifetime: 30m, 12h, 7d, 2w or a number of seconds, or issue a token that never expires
  • Put your own JSON data in the token, such as a user id and role, and read it after the check
  • Set the subject (sub), issuer (iss) and audience (aud) if the receiving system checks them
  • Verify tokens that your own server signed with HS512 and the same secret key

Blocks in the builder

  • Issue JWT token

    Action · $0.001 per run

    Signs a new token with HS512. Fields: secret key, subject (sub), JSON data, lifetime, issuer (iss) and audience (aud). Returns the token, the expiry time expires_at, success and error_text.

  • Verify JWT token

    Action · $0.001 per run

    Checks the signature and expiry of a token with the same secret key. Returns valid (true or false), the token data in payload and the reason for a rejection in error_text, such as an expired token.

How to set it up

  1. 1

    Create a secret key

    Generate a long random string of at least 32 characters and save it in the project variables. This key signs the tokens, so never show it to anyone. Both blocks need the same key.

  2. 2

    Build the token endpoint

    Create a scheme and add the webhook trigger with the POST method and a path such as /token. Connect the sign jwt block: paste the key, put the user id from the request into the subject (sub) field and set a lifetime, for example 7d. Return the token with the webhook response block.

  3. 3

    Build the token check

    Add a second webhook trigger for the protected request and connect the validate jwt block. Put the token from the request into the token field and the same key into the secret field. Use the condition block on valid: do the work when it is true, answer with code 401 when it is false.

  4. 4

    Turn the scheme on and test it

    Turn the scheme on, click the API button in the builder and request a token on the Try it tab, then send it to the protected webhook. The Jwt Token Auth template gives you a ready base. While the scheme is on, it costs $0.0042 per hour.

Templates with this service

  • JWT issue and check (Jwt Token Auth)

    A ready-made JWT auth template: one address issues a signed token, the other checks it and answers with the result. Free balance every month, no card needed.

Frequently asked questions

Issuing a token costs $0.001, and a check costs another $0.001. A token that fails the check is not charged. An enabled scheme costs $0.0042 per hour. Your balance is topped up to $3.50 for free every month, no card needed. A scheme kept on around the clock for a month spends most of that on scheme hours.

HS512: the token is signed and verified with one shared secret key. Tokens with other algorithms, such as RS256 with a public and private key pair, are rejected by the validate jwt block.

A long random string of at least 32 characters. Keep it in the project variables and insert it into both blocks from there. If the key leaks, replace it: all tokens issued before will stop passing the check.

No. Anyone who has the token can read what is inside, the signature only protects it from forgery. Put a user id, a role and other data that is safe to show.

In the token lifetime field, enter a number with a unit: 30m, 12h, 7d or 2w, or just a number of seconds, such as 3600. Empty or 0 means the token never expires. The block returns the expiry time in expires_at, and after it the check rejects the token.

That header usually holds the word Bearer and then the token. The check block needs the token without the word Bearer: cut it off with the run custom script block, or ask the client to send the token in a separate header or body field.

Build your first scheme for free

Sign-up is free and needs no card. Every month the balance is topped up to $3.50 for free, enough for about 3,500 runs of basic blocks.

Build it in the builder