Build a JWT Authentication API with Express and TypeScript

What you will build

By the end of this tutorial you will have a working authentication API with three routes: a register endpoint that hashes a password before storing it, a login endpoint that checks the hash and returns a signed JWT, and a protected endpoint that reads the token from an Authorization header and returns the current user. The five source files wire together cleanly: a types module, an in-memory user store, a JWT helper, an authenticate middleware, and the Express routes. Every file is in this page. Paste each one into a fresh project, follow the setup steps, and it runs. No repo to clone.

Why this matters: most real backends gate at least some routes behind authentication. This tutorial shows the exact pattern (hash on the way in, compare on the way in again, sign a token, verify it on protected routes) so you understand what is happening instead of copying a library that hides the details.

The stack, and why each piece is here

Four dependencies, each standard for its job.

Express handles HTTP routing; it is the framework covered in most free Node.js courses and the one you are most likely to find in an existing codebase. jsonwebtoken signs and verifies JWTs; it is the most widely used JWT library for Node (~10M downloads a week). bcryptjs hashes passwords; it is pure JavaScript so it installs without native bindings on any platform (~2M downloads a week). TypeScript ties it together so every shape is written down once and checked everywhere.

JWT (JSON Web Token) is the standard for stateless auth in HTTP APIs. The server signs a small JSON payload with a secret key and gives it to the client. The client sends it back in the Authorization header on every protected request. The server verifies the signature and trusts the payload, no session store needed. This is how most REST APIs and mobile backends work in practice.

Setup

Create a fresh project and install the packages. Express, jsonwebtoken, and bcryptjs are the three runtime dependencies; the rest is dev tooling.

mkdir auth-api
cd auth-api
npm init -y
npm install express jsonwebtoken bcryptjs
npm install -D typescript tsx @types/node @types/express @types/jsonwebtoken @types/bcryptjs

Add a tsconfig.json at the project root:

{
  "compilerOptions": {
    "target": "ES2022",
    "module": "Node16",
    "moduleResolution": "Node16",
    "strict": true,
    "esModuleInterop": true,
    "skipLibCheck": true,
    "rootDir": "src",
    "outDir": "dist",
    "types": ["node"]
  },
  "include": ["src"]
}

Then open package.json, add "type": "module", and set these scripts:

{
  "type": "module",
  "scripts": {
    "dev": "tsx watch src/index.ts",
    "build": "tsc",
    "start": "node dist/index.js"
  }
}

All five source files below go in a src/ directory you create in the project root.

Define the types

Start with the shape of the data. One types module, imported everywhere, keeps the whole API consistent. User is the stored record (email + hashed password). PublicUser is what routes return: the same shape with the hash stripped out, so a password hash never leaves the server. TokenPayload is what gets signed into and read back from the JWT.

Create src/types.ts:

export interface User {
  id: number;
  email: string;
  passwordHash: string;
}

export interface PublicUser {
  id: number;
  email: string;
}

export interface TokenPayload {
  sub: number;
  email: string;
}

Build the in-memory user store

The store keeps users in a plain array, the same approach as the REST API tutorial. It resets on restart (no database to configure) so you can focus on the auth pattern. Swapping this for a real database later is a change to this one file; the routes stay the same.

Create src/db.ts:

import type { User } from "./types.js";

const users: User[] = [];
let nextId = 1;

export function findByEmail(email: string): User | undefined {
  return users.find((u) => u.email === email);
}

export function findById(id: number): User | undefined {
  return users.find((u) => u.id === id);
}

export function createUser(email: string, passwordHash: string): User {
  const user: User = { id: nextId++, email, passwordHash };
  users.push(user);
  return user;
}

Write the JWT helpers

This module wraps jsonwebtoken so the rest of the app never calls it directly. Two functions: signToken returns a signed string, verifyToken decodes and validates it. When verification fails (wrong secret, expired token, tampered payload) jsonwebtoken throws, and the middleware catches it.

The secret comes from an env var. In development, the fallback string works fine. In production, set JWT_SECRET to a random 256-bit value and never commit it.

Create src/auth.ts:

import jwt from "jsonwebtoken";
import type { TokenPayload } from "./types.js";

const SECRET = process.env.JWT_SECRET ?? "dev-secret-change-in-production";
const EXPIRES_IN = "24h";

export function signToken(payload: TokenPayload): string {
  return jwt.sign(payload, SECRET, { expiresIn: EXPIRES_IN });
}

export function verifyToken(token: string): TokenPayload {
  return jwt.verify(token, SECRET) as TokenPayload;
}

Write the authenticate middleware

Express middleware is a function that runs before a route handler. This one reads the Authorization header, strips the Bearer prefix, verifies the token, and attaches the decoded payload to req.user so route handlers can read it without re-verifying. If anything is wrong (missing header, bad token, expired) it sends a 401 and stops the chain by not calling next().

The declare global block extends Express's Request type so TypeScript knows req.user exists on protected routes. This is the standard pattern for Express type augmentation.

Create src/middleware.ts:

import { type Request, type Response, type NextFunction } from "express";
import { verifyToken } from "./auth.js";
import type { TokenPayload } from "./types.js";

declare global {
  namespace Express {
    interface Request {
      user?: TokenPayload;
    }
  }
}

export function authenticate(req: Request, res: Response, next: NextFunction): void {
  const header = req.headers.authorization;
  if (!header?.startsWith("Bearer ")) {
    res.status(401).json({ error: "Missing or malformed Authorization header." });
    return;
  }
  const token = header.slice(7);
  try {
    req.user = verifyToken(token);
    next();
  } catch {
    res.status(401).json({ error: "Token is invalid or has expired." });
  }
}

Build the three routes

Three routes in an Express Router. Notice the validation pattern on /register: the email check is lightweight (does it contain @), the password check enforces a minimum length, and a duplicate-email check returns 409 Conflict. The 401 response on /login uses the same message whether the email does not exist or the password is wrong, so you never tell an attacker which half was right.

Create src/routes.ts:

import { Router, type Request, type Response } from "express";
import bcrypt from "bcryptjs";
import { signToken } from "./auth.js";
import { createUser, findByEmail, findById } from "./db.js";
import { authenticate } from "./middleware.js";
import type { PublicUser } from "./types.js";

export const router = Router();

// POST /register: { email, password } -> 201 with the new user (no password hash).
router.post("/register", async (req: Request, res: Response) => {
  const { email, password } = req.body ?? {};
  if (typeof email !== "string" || !email.includes("@")) {
    res.status(400).json({ error: "A valid email is required." });
    return;
  }
  if (typeof password !== "string" || password.length < 8) {
    res.status(400).json({ error: "Password must be at least 8 characters." });
    return;
  }
  if (findByEmail(email)) {
    res.status(409).json({ error: "An account with that email already exists." });
    return;
  }
  const passwordHash = await bcrypt.hash(password, 10);
  const user = createUser(email, passwordHash);
  const publicUser: PublicUser = { id: user.id, email: user.email };
  res.status(201).json(publicUser);
});

// POST /login: { email, password } -> { token } on success, 401 on bad credentials.
router.post("/login", async (req: Request, res: Response) => {
  const { email, password } = req.body ?? {};
  const user = typeof email === "string" ? findByEmail(email) : undefined;
  if (!user || typeof password !== "string") {
    res.status(401).json({ error: "Invalid email or password." });
    return;
  }
  const match = await bcrypt.compare(password, user.passwordHash);
  if (!match) {
    res.status(401).json({ error: "Invalid email or password." });
    return;
  }
  const token = signToken({ sub: user.id, email: user.email });
  res.json({ token });
});

// GET /me: returns the current user. Requires a valid Bearer token.
router.get("/me", authenticate, (req: Request, res: Response) => {
  const user = findById(req.user!.sub);
  if (!user) {
    res.status(404).json({ error: "User not found." });
    return;
  }
  const publicUser: PublicUser = { id: user.id, email: user.email };
  res.json(publicUser);
});

Wire up the app

The entry point creates the Express app, adds the JSON body parser so req.body is a real object, mounts the router, and starts listening. Create src/index.ts:

import express from "express";
import { router } from "./routes.js";

const app = express();
app.use(express.json());
app.use(router);

const port = Number(process.env.PORT) || 3000;
app.listen(port, () => {
  console.log(`Auth API listening on http://localhost:${port}`);
});

Run and test all three routes

Start the server in dev mode:

npm run dev
# -> Auth API listening on http://localhost:3000

In a second terminal, walk through the full auth flow with curl. Register first:

# Register
curl -X POST http://localhost:3000/register \
  -H "Content-Type: application/json" \
  -d '{"email":"[email protected]","password":"secret123"}'
# -> {"id":1,"email":"[email protected]"}

Then log in to get a token:

# Login
curl -X POST http://localhost:3000/login \
  -H "Content-Type: application/json" \
  -d '{"email":"[email protected]","password":"secret123"}'
# -> {"token":"eyJhbGciOi..."}

Copy the token value from the response, then call the protected endpoint:

# Call a protected route
curl http://localhost:3000/me \
  -H "Authorization: Bearer eyJhbGciOi..."
# -> {"id":1,"email":"[email protected]"}

Test the error cases too. They are the part that matters in real auth:

• Call /me without a token: should get 401 Missing or malformed Authorization header.
• Call /me with the string Bearer garbage: should get 401 Token is invalid or has expired.
• Register the same email twice: should get 409 An account with that email already exists.
• Log in with the wrong password: should get 401 Invalid email or password. (same message as wrong email, intentional)

What to try next

You have a working auth API. Three moves take it toward something you would run in production.

Add refresh tokens. A 24-hour JWT means users are logged out every day. The standard fix is a short-lived access token (15 min) plus a long-lived refresh token stored in an httpOnly cookie. When the access token expires, a POST /refresh route issues a new one without making the user log in again. The middleware barely changes; the route is new.

Add a real database. The in-memory store loses users on restart. Swap src/db.ts for PostgreSQL with Drizzle or Prisma; the routes and middleware stay the same because the store interface does not change. For a real-world example, see how the URL shortener tutorial adds SQLite persistence at /tutorials/build-url-shortener-express-typescript-sqlite.

Add rate limiting. Install express-rate-limit and add a tight limiter on /login (10 requests per 15 minutes per IP). Without it, the login route is open to credential-stuffing attacks. It is a four-line middleware add.

For the full backend learning path, /learn/backend sequences free courses in order, and the /roadmap/backend shows the skills that come after.