# AdonisJS JWT

Production JWT authentication for AdonisJS v7 with rotating refresh tokens, JWKS, and hardened cookie transport.

Full corpus (all pages, one document): https://adonisjs-jwt.pages.dev/llms-full.txt

## Pages

- [API reference](https://adonisjs-jwt.pages.dev/api/index.md) — Public factories, services, guard methods, contracts, errors, events, and commands.
- [Browser cookies and CSRF](https://adonisjs-jwt.pages.dev/browser-cookies/index.md) — Configure hardened first-party browser sessions with double-submit CSRF protection.
- [Configuration](https://adonisjs-jwt.pages.dev/configuration/index.md) — Register the JWT guard and configure algorithms, storage, transports, and revocation.
- [Installation](https://adonisjs-jwt.pages.dev/installation/index.md) — Install the package, generate signing keys, and run its migrations.
- [Keys, JWKS, and rotation](https://adonisjs-jwt.pages.dev/key-management/index.md) — Select a key driver, publish public keys, and rotate without invalidating live tokens.
- [Token lifecycle](https://adonisjs-jwt.pages.dev/lifecycle/index.md) — Implement login, authentication, refresh rotation, replay response, and logout.
- [Migrate from @maximemrf/adonisjs-jwt](https://adonisjs-jwt.pages.dev/migration/index.md) — Replace the legacy guard safely without accepting old tokens under weaker rules.
- [AdonisJS JWT](https://adonisjs-jwt.pages.dev/overview/index.md) — Production JWT authentication for AdonisJS v7.
- [Security operations](https://adonisjs-jwt.pages.dev/security/index.md) — Threat model, deployment controls, observability, and incident response.