JWT Auth Boilerplate (Express, Access + Refresh Tokens)

A production-ready JWT authentication boilerplate

A complete JWT auth system for Node.js/Express: register, login, rotating refresh tokens, protected routes and logout. Password hashing with scrypt (no external auth service needed).

What's included

• Register + login — full flow
• Rotating refresh tokens — old tokens revoked
• Protected routes — authenticate middleware
• scrypt password hashing — built-in crypto
• Cookie support — secure httpOnly refresh cookie
• Validation — email/password normalize + checks
• 35 passing tests — node:test suite
• Full docs — endpoints, examples, env

Quick Start

npm install
npm start

Stack

Node.js 18+ · Express · pure ESM

Use cases

• SaaS auth foundation
• Internal API protection
• Learning JWT flows
• Microservice gateways