Get the latest tech news
Self-Signed JWTs
Self-signed JWTs are the future of auth.
Let’s see how we can get rid of secret versus publishable keys and separate client and admin SDKs. Store your app’s private JWK on the server Using whatever auth scheme you have, implement a function that returns whether to allow a given action Express privileged actions as claims in your JWT—if a privileged action is allowed, include the claim in the payload and sign the JWT with your private key Give your client SDK a function that reverse-proxies to your API, adding a signed JWT to the request’s Authorization header with any privileged claims you want to include Simple: make your API return a payment URL when a request is made with a public key that isn’t associated with a paid account.
Or read this on Hacker News
