Auth

User authorization is done using JSON Web Tokens. The JWTs issued by the server are valid for one day. See the API docs for the login endpoint that issues the JWTs.

INFO

JWTs are cryptographically signed JSON objects containing user information. The JWT is signed by the server using a secret key. A user can thus claim his or her identity using the signed JWT. The server can verify this claim by checking if the signature is correct.

See https://jwt.io (opens new window) and RFC 7519 (opens new window) for more information.

Secret Key

The HS256 algorithm is used to sign JWTs. HS256 uses a single secret key to sign payloads. It is important to specify a secret key, as potential malicious users could otherwise circumvent auth.

The secret key must be specified under the JWT_KEY key in the .env file. See the customizing section for more information on available environment variables.

Authorization

JWTs issued by the server and returned from the API login endpoint must be saved client-side, for example in localStorage.

When calling an endpoint API requiring auth, the saved JWT must be passed as an HTTP header. Use the Authorization header for this. The header has the following form: Authorization: Bearer <JWT> where <JWT> is the saved JWT.