Built-in Middlewares

JWT and JWKS Authentication

Verify JSON Web Tokens (JWT) and remote JWKS key sets (Auth0, Clerk, Supabase) with built-in typed authentication middleware for Taser.js APIs.

Taser.js includes built-in JWT and JWKS authentication middlewares that verify bearer tokens and inject typed claims on the state facet (jwtPayload).

JWT Authentication (@taserjs/router/middleware/jwt)

The jwt() middleware extracts the Authorization: Bearer <token> header, verifies the signature using your secret key, and attaches the typed payload via next({ jwtPayload }).

src/routes/dashboard.ts
import { jwt } from "@taserjs/router/middleware/jwt";
import { t } from "@taserjs/router";

type JwtClaims = {
  sub: string;
  email: string;
  role: "user" | "admin";
};

export default t.layout("/dashboard").use(
  jwt<JwtClaims>({
    secret: process.env.JWT_SECRET!,
    alg: "HS256",
  }),
);

Accessing Claims in Downstream Routes

Any route inside src/routes/dashboard/ receives state.jwtPayload with complete type inference:

src/routes/dashboard/profile.get.ts
import { json } from "@taserjs/router/reply";
import { t } from "@taserjs/router";

export default t.get("/dashboard/profile").handler(async ({ ctx, state }) => {
  // 100% typed from JwtClaims:
  const userId = state.jwtPayload.sub;
  const userEmail = state.jwtPayload.email;
  const userRole = state.jwtPayload.role;

  const user = await ctx.db.getUser(userId);
  return json(user);
});

JWKS Authentication (@taserjs/router/middleware/jwk)

For auth providers like Auth0, Clerk, Firebase, AWS Cognito, or Supabase, use jwk() to verify tokens against remote JSON Web Key Sets:

src/routes/api.ts
import { jwk } from "@taserjs/router/middleware/jwk";
import { t } from "@taserjs/router";

type ClerkPayload = {
  sub: string;
  iss: string;
  azp?: string;
};

export default t.layout("/api").use(
  jwk<ClerkPayload>({
    jwks_uri: "https://clerk.your-domain.com/.well-known/jwks.json",
  }),
);

Configuration Options

JWT Options

Prop

Type

JWK Options

Prop

Type

Next Steps

Security & Utilities

Configure secure headers, CSRF, and compression.

Layouts and Middleware

Learn how to nest and scope auth layouts.

CORS Middleware

Configure Cross-Origin Resource Sharing (CORS) using @taserjs/router/cors with static origins, dynamic domain resolvers, and preflight support.

Security and Utility Middlewares

Discover built-in middlewares for security headers, CSRF defense, body size limits, ETags, Server-Timing, and response compression.

On this page

JWT Authentication (@taserjs/router/middleware/jwt)Accessing Claims in Downstream RoutesJWKS Authentication (@taserjs/router/middleware/jwk)Configuration OptionsJWT OptionsJWK OptionsNext Steps