AdonisJS JWT

@rikology/adonisjs-jwt is an AdonisJS v7 auth guard built around short-lived JWT access tokens and hashed, rotating opaque refresh tokens.

Why this package

Strict verification: pinned algorithms plus required issuer, audience, subject, ID, and time claims.
Safe renewal: one-time refresh rotation, family lineage, replay detection, and bulk revocation.
Deployable key management: environment, encrypted database, HS256, and remote-JWKS drivers.
Browser-ready transport: hardened httpOnly cookies with double-submit CSRF protection.
Operations built in: public JWKS, zero-downtime rotation, typed events, stable JSON errors, and OpenTelemetry spans.

Node.js 24 or newer
AdonisJS 7 and @adonisjs/auth 10
@adonisjs/lucid 22 for the built-in refresh-token store and database key driver

node ace add @rikology/adonisjs-jwt
node ace jwt:make-key
node ace migration:run

Then register the guard and protect a route:

router
  .get('/me', ({ auth }) => auth.getUserOrFail())
  .use(middleware.auth({ guards: ['jwt'] }))

The generated controller demonstrates login, refresh, logout, and logout-all. Continue with the token lifecycle before exposing those endpoints.