AdonisJS v7 · Node.js 24+
JWT authentication built for the whole session.
Short-lived signed access tokens. Rotating opaque refresh tokens. Key overlap, browser transport, revocation, events, and traces without weakening verification.
node ace add @rikology/adonisjs-jwt
node ace jwt:make-key
node ace migration:run
// config/auth.ts
jwt: jwtGuard({
provider,
keySet: jwtKeySet,
refreshStore: jwtRefreshTokenStore,
config: jwtConfig,
})Strict by default
Signed access tokens
Pinned algorithms, required claims, issuer and audience validation, and public-only JWKS.
Replay resistant
Rotating refresh families
Hashed opaque secrets, one-time rotation, grace windows, family revocation, and reuse events.
First-party ready
Hardened browser sessions
Path-scoped httpOnly cookies, SameSite enforcement, and timing-safe double-submit CSRF.
Start with the threat model, not a token helper.
Review key custody, refresh replay, cookie CSRF, and incident response before exposing authentication routes.