JWT Authentication

This lesson covers JWT Authentication. You do not need to memorize everything. Understand the flow first.

What you will learn

• What jwt authentication means — in normal words, not textbook words
• How it works step by step
• Code you can run today on your laptop
• Where teams use this in real projects

Before you start

• Software: Node.js LTS from nodejs.org, VS Code, and a terminal
• Knowledge: Earlier lessons in this Node.js course
• Previous lesson: Validation — Complete Guide

Explain it simply

JWT (JSON Web Token) is a signed string the client sends to prove who they are. The server verifies the signature without storing sessions in memory.

Why developers use this

• Stateless auth for APIs and mobile apps
• Works across multiple servers
• Common in interviews and real projects

How it works (step by step)

1. Client sends HTTP method + URL + optional JSON body.
2. Server validates input — reject bad data with 400.
3. Business logic reads or writes the database.
4. Response is JSON with a clear message the frontend can show.

Code example — type this yourself

const jwt = require('jsonwebtoken');
const token = jwt.sign({ userId: 1 }, process.env.JWT_SECRET, { expiresIn: '1h' });
const payload = jwt.verify(token, process.env.JWT_SECRET);
console.log(payload.userId);

Never hard-code JWT_SECRET. Put it in .env. Tokens expire — clients must log in again.

What each part does

• const jwt = require('jsonwebtoken'); — Loads a built-in module or package you installed with npm.
• const token = jwt.sign({ userId: 1 }, process.env.JWT_SECRET, { expiresIn: '1h' }); — Reads config from environment variables — safe place for secrets.
• const payload = jwt.verify(token, process.env.JWT_SECRET); — Reads config from environment variables — safe place for secrets.
• console.log(payload.userId); — Prints to the terminal — great for learning; use proper logging in production.

Real life: where JWT Authentication shows up

A mobile app talks to a Node backend using JWT Authentication. The phone sends JSON; the server validates, saves to PostgreSQL, and returns clear success or error messages.

Try it yourself — hands-on

1. npm install jsonwebtoken dotenv
2. Sign a token and log it
3. Verify it and log userId

Common mistakes (avoid these)

• Storing JWT_SECRET in source code committed to git.

Interview note

Be ready to explain JWT Authentication with a real trade-off: what problem it solves and what you would not use it for.

Summary

• sign creates a token
• verify checks it and returns payload
• Keep the secret in environment variables