JWT
Token signing and verification with HMAC-SHA256.
1 min readEdit this page
Setup
import { JWT } from '@restjs/auth'
const jwt = new JWT(process.env.JWT_SECRET) // min 32 charsSign
const token = jwt.sign({ sub: String(user.id), role: 'admin' }, { expiresIn: '7d' })Verify
const payload = jwt.verify(token)Time formats
1h, 7d, 30m, or seconds as number.
Warning
Signature comparison uses constant-time comparison to prevent timing attacks.