Authentication
A complete, production-grade authentication stack built into the framework — JWT access tokens, server-side sessions, API keys, OAuth2/OIDC with PKCE, WebAuthn passkeys, refresh tokens, and role-based access control. No third-party auth service required.
Why authentication is built in
Most backends bolt authentication on with a handful of third-party libraries that each own a slice of the problem — token signing here, sessions there, OAuth somewhere else. StreetJS treats authentication as a first-class concern instead, so every layer of a modern auth stack ships in the box, shares one model, and is covered by tests. You own your user data and avoid a per-active-user bill from an external identity service.
What’s included
JWT & sessions
Signed JWT access tokens plus server-side sessions and refresh tokens, with secure cookie handling out of the box.
Auth guide →OAuth2 / OIDC
Authorization Code flow with PKCE for social and enterprise identity providers.
OAuth2 docs →WebAuthn passkeys
Passwordless, phishing-resistant authentication using platform and roaming authenticators.
WebAuthn docs →Role-based access control
Roles, permissions, and route guards for authorizing requests once a user is authenticated.
RBAC docs →Prefer a managed identity service? First-party plugins integrate StreetJS auth with Auth0, Clerk, Firebase, and Supabase. See the full list on the Plugins page.
Example
Issue a token, then protect routes with the auth middleware:
1
2
3
4
5
6
7
8
9
10
11
12
import { streetApp, JwtService, authMiddleware } from 'streetjs';
const jwt = new JwtService(process.env.JWT_SECRET!);
const app = streetApp({ port: 3000 });
// Sign a token after verifying credentials
const token = jwt.sign({ sub: user.id, roles: ['member'] }, { expiresIn: '15m' });
// Require a valid token on everything below
app.use(authMiddleware(jwt));
await app.listen();
Next steps
- Read the Authentication guide
- Review the Security model
- Start a project with the Getting Started guide