Why should you care?

MernVerse needs identity without storing server sessions for every request (stateless APIs).

See it live — copy this example

Run examples in your MernVerse client/ (Vite React) or server/ (Express) folders. Keep secrets in .env.

import jwt from 'jsonwebtoken';

const token = jwt.sign(
  { sub: user.id, role: user.role },
  process.env.JWT_SECRET,
  { expiresIn: '1h' }
);

// middleware
const payload = jwt.verify(header.slice(7), process.env.JWT_SECRET);

Run Example »

Edit the code below and click Run to see the result in Toolliyo’s live editor.

What happened?

• Keep JWT_SECRET long and private.
• Put only non-sensitive claims in the payload.
• Verify on every protected route.

Practice next

1. Install jsonwebtoken.
2. Sign on login success.
3. Verify in auth middleware.
4. Add role to claims.
5. Return token in JSON { token }.

Remember

Sign after auth. Bearer scheme. Short expiry + refresh later.

Login token

SPA must call /api/notes securely.

Outcome: Protected route accepts a valid JWT.