Skip to content

JWT

JwtPlugin adds POST /auth/token and GET /auth/jwks to the router and, when installed, injects a set-auth-jwt response header on GET /auth/get-session carrying a freshly-signed JWT for the active user.

Endpoints

  • POST /auth/token — exchange the current session for a JWT (default expiry 15 minutes).
  • GET /auth/jwks — public JWKS document used to verify those tokens.

Revocation

JWT access tokens remain valid until they expire because they are stateless. /auth/sign-out, password reset, and session revocation clear database sessions and refresh tokens, but they cannot invalidate already-issued JWT access tokens without adding a server-side denylist. Keep expires_in short for JWTs that grant direct API access.

Options

JwtOptions covers algorithm choice (alg, default Ed25519), expires_in, issuer, audience, rotation_interval, grace_period, disable_setting_jwt_header, disable_private_key_encryption, jwks_path, and token_path. The plugin also accepts a custom payload_builder and a signer_factory for KMS-backed signing. Duration options accept datetime.timedelta, numeric seconds, or compact strings such as "15m" and "30d" — see the KMS signing guide.

Example

from datetime import timedelta

from pydantic import SecretStr

from fastauth import FastAuth, FastAuthOptions
from fastauth.database import memory
from fastauth.plugins.jwt import JwtOptions
from fastauth import email_password, jwt

auth = FastAuth(
    FastAuthOptions(
        secret_key=SecretStr("replace-me-with-your-application-secret"),
        database=memory(),
    ),
    plugins=[
        email_password(),
        jwt(JwtOptions(
            issuer="https://app.example.com",
            audience="https://api.example.com",
            rotation_interval=timedelta(days=30),
        )),
    ],
)