A production-ready JWT authentication boilerplate
A complete JWT auth system for Node.js/Express: register, login, rotating refresh tokens, protected routes and logout. Password hashing with scrypt (no external auth service needed).
What's included
- Register + login — full flow
- Rotating refresh tokens — old tokens revoked
- Protected routes —
authenticate middleware
- scrypt password hashing — built-in crypto
- Cookie support — secure httpOnly refresh cookie
- Validation — email/password normalize + checks
- 35 passing tests — node:test suite
- Full docs — endpoints, examples, env
Quick Start
npm install
npm start
Stack
Node.js 18+ · Express · pure ESM
Use cases
- SaaS auth foundation
- Internal API protection
- Learning JWT flows
- Microservice gateways
