Skip to content

Latest commit

 

History

History
 
 

server-api

Folders and files

NameName
Last commit message
Last commit date

parent directory

..
.env.example
.env.example
 
 
README.md
README.md
 
 
package.json
package.json
 
 
server.js
server.js
 
 

README.md

Express Authorization for RS256-Signed Tokens

This sample demonstrates how to protect endpoints in an Express API by verifying an incoming JWT access token signed by Auth0. The token must be signed with the RS256 algorithm and must be verified against your Auth0 JSON Web Key Set.

Getting Started

You must ensure that the APIs section is enabled in your Auth0 dashboard. To do so, go to the Advanced Settings area and verify that Enable APIs Section is switched on.

Next, navigate to APIs in the sidebar and create a new API. The identifier for your API will be required later.

Add scope read:messages in Api Section -> Scope Tab

Setup the .env File

Rename .env.example to .env and provide these values manually.

Running the example

Start all root apps

The API will be served at http://localhost:3090.

Endpoints

The sample includes these endpoints:

GET /api/public

  • An unprotected endpoint which returns a message on success. Does not require a valid JWT access token.

GET /api/private

  • A protected endpoint which returns a message on success. Requires a valid JWT access token.

GET /api/private/admin

  • A protected endpoint which returns a message on success. Requires a valid JWT access token with a scope of read:messages.