JWT auth for your API without code: a template that issues and checks tokens

Chain of blocks

1. 1

   Trigger

   button issues a token by hand, without a request, which is handy for checking the settings of the sign jwt block. The button is free.

2. 2

   Trigger · Webhook (trigger)

   webhook for issuing receives the token request. In the template it uses the GET method and the "/" path, so set your own path, for example /token.

3. 3

   Action · Issue JWT token

   sign jwt signs the token with HS512. You fill in the secret key, the token owner (sub), the data inside the token and its lifetime. The block returns token and the expiry time expires_at.

4. 4

   Action · Webhook response

   webhook response sends the issued token back to the sender. The response body is empty in the template: put an object with the token into body json.

5. 5

   Trigger · Webhook (trigger)

   webhook for checking receives a request with a token. It also uses GET and the "/" path, so it needs its own path, for example /verify, or requests never reach it.

6. 6

   Action · Verify JWT token

   validate jwt checks the signature and expiry of the token with the same secret key. It returns valid (true or false), the token data in payload and the reason for a refusal in error_text.

7. 7

   Action · Webhook response

   webhook response answers with the check result. Its body is empty too: return valid and payload from the check block.

What it is good for

• Sign-in for a mobile app or a customer account: issue a token after checking the login, then let requests in only with it
• Closing your own API built on nana800 webhooks to outside requests
• Temporary access for a partner or contractor for a week or a month
• Checking tokens that your own server signed with HS512 and the same key
• Passing a user ID and role between systems inside a signed token

How to set it up

1. 1

   Create a scheme from the template

   In the builder open Templates, find the Jwt Token Auth template and click Use. Choose the project and scheme and click Create: both parts appear, token issuing and token checking.

2. 2

   Give the webhooks different paths

   In the first webhook block pick the POST method and the /token path, in the second one POST and /verify. Both use the "/" path in the template, and while the paths are the same, the second webhook gets no requests.

3. 3

   Set up token issuing

   In the sign jwt block paste the secret key: a long random string of at least 32 characters. Insert the user ID from the request body into the owner (sub) field and set the lifetime, for example 7d. In the next response block put an object with a token field into body json and insert token from the sign jwt block.

4. 4

   Set up token checking

   In the validate jwt block insert the token from the request into the jwt token field, for example the token field of the body, and paste the same key as in sign jwt into jwt secret. In the last response block return valid and payload from the check block.

5. 5

   Turn the scheme on and test it

   Turn the scheme on, then press the button in the button trigger and see the token in the result of the sign jwt block in the run history. The response block shows an error because nobody waits for the answer, which is expected. Next click the API button in the builder, request a token on the Try it tab and send it to /verify. While the scheme is on, it costs $0.0042 per hour.

Services in this template

• Webhook

  Receive website leads and service events with a webhook and answer requests with no server and no code. Free balance every month, no card needed.

• JWT

  Issue and verify JWT tokens without code: token login for your own API, token lifetime and your own data inside. Free balance every month, no card needed.