{"id":30098523,"url":"https://github.com/nearform/fastify-jwt-jwks","last_synced_at":"2025-08-09T13:07:37.945Z","repository":{"id":162112801,"uuid":"636718701","full_name":"nearform/fastify-jwt-jwks","owner":"nearform","description":"JSON Web Key Set (JWKS) verification plugin for Fastify","archived":false,"fork":false,"pushed_at":"2025-04-20T01:13:58.000Z","size":775,"stargazers_count":13,"open_issues_count":2,"forks_count":9,"subscribers_count":37,"default_branch":"master","last_synced_at":"2025-07-25T20:07:52.272Z","etag":null,"topics":["authentication","fastify","jwks","jwt"],"latest_commit_sha":null,"homepage":"","language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":"nearform/fastify-auth0-verify","license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/nearform.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE.md","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2023-05-05T13:38:09.000Z","updated_at":"2025-04-20T01:13:05.000Z","dependencies_parsed_at":null,"dependency_job_id":"d3a08e7b-3f79-409b-a588-d415d275f621","html_url":"https://github.com/nearform/fastify-jwt-jwks","commit_stats":{"total_commits":295,"total_committers":37,"mean_commits":7.972972972972973,"dds":0.5118644067796609,"last_synced_commit":"f031c78af230513de3a94cf246e887986d5a1cb4"},"previous_names":[],"tags_count":27,"template":false,"template_full_name":null,"purl":"pkg:github/nearform/fastify-jwt-jwks","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffastify-jwt-jwks","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffastify-jwt-jwks/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffastify-jwt-jwks/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffastify-jwt-jwks/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/nearform","download_url":"https://codeload.github.com/nearform/fastify-jwt-jwks/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffastify-jwt-jwks/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":269537452,"owners_count":24434166,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-08-09T02:00:10.424Z","response_time":111,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["authentication","fastify","jwks","jwt"],"created_at":"2025-08-09T13:07:37.012Z","updated_at":"2025-08-09T13:07:37.916Z","avatar_url":"https://github.com/nearform.png","language":"JavaScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# fastify-jwt-jwks\n\n[![Package Version](https://img.shields.io/npm/v/fastify-jwt-jwks.svg)](https://npm.im/fastify-jwt-jwks)\n[![ci](https://github.com/nearform/fastify-jwt-jwks/actions/workflows/ci.yml/badge.svg)](https://github.com/nearform/fastify-jwt-jwks/actions/workflows/ci.yml)\n\nJSON Web Key Set (JWKS) verification plugin for Fastify, internally uses [@fastify/jwt](https://www.npmjs.com/package/@fastify/jwt).\n\n#### Note\n\nJSON Web Key Sets (JWKS) are used to verify that a signed JWT originated from a particular authorization server, and that the token hasn't been tampered with. If you are looking to implement JWT authentication in your Fastify application you may be looking for [@fastify/jwt](https://www.npmjs.com/package/@fastify/jwt).\n\n## Installation\n\nJust run:\n\n```bash\nnpm install fastify-jwt-jwks --save\n```\n\n## Usage\n\nRegister as a plugin, providing one or more of the following options:\n\n- `jwksUrl`: JSON Web Key Set url (JWKS). The public endpoint returning the set of keys that contain amongst other things the keys needed to verify JSON Web Tokens (JWT). Eg. https://domain.com/.well-known/jwks.json\n- `audience`: The intended consumer of the token. This is typically a set of endpoints at which the token can be used. If you provide the value `true`, the domain will be also used as audience. Accepts a string value, or an array of strings for multiple audiences.\n- `issuer`: The domain of the system which is issuing OAuth access tokens. By default the domain will be also used as audience. Accepts a string value, or an array of strings for multiple issuers.\n- `secret`: The OAuth client secret. It enables verification of HS256 encoded JWT tokens.\n- `complete`: If to return also the header and signature of the verified token.\n- `secretsTtl`: How long (in milliseconds) to cache RS256 secrets before getting them again using well known JWKS URLS. Setting to 0 or less disables the cache. Defaults to 1 week.\n- `cookie`: Used to indicate that the token can be passed using cookie, instead of the Authorization header.\n  - `cookieName`: The name of the cookie.\n  - `signed`: Indicates whether the cookie is signed or not. If set to `true`, the JWT will be verified using the unsigned value.\n- `namespace`: A string used to namespace the decorators of this plugin. This is to allow this plugin to be applied multiple times to a single Fastify instance. See the description of the [namespace parameter](https://github.com/fastify/fastify-jwt?tab=readme-ov-file#namespace) in @fastify/jwt.\n\nSince this plugin is based on the [@fastify/jwt](https://www.npmjs.com/package/@fastify/jwt) `verify`, it is also possibile to pass the options documented [here](https://github.com/fastify/fastify-jwt#verify), see the example below.\n\nOnce registered, your fastify instance and request will be decorated as describe by `@fastify/jwt`.\n\nIn addition, the request will also get the `authenticate` decorator.\n\nThis decorator can be used as `preValidation` hook to add authenticate to your routes. The token information will be available in `request.user`.\n\nExample:\n\n```js\nconst fastify = require('fastify')\nconst server = fastify()\n\nawait server.register(require('fastify-jwt-jwks'), {\n  jwksUrl: '\u003cJWKS url\u003e',\n  audience: '\u003capp audience\u003e'\n})\n\nserver.get('/verify', { preValidation: server.authenticate }, (request, reply) =\u003e {\n  reply.send(request.user)\n})\n\nserver.listen(0, err =\u003e {\n  if (err) {\n    throw err\n  }\n})\n```\n\nYou can configure there to be more than one JWT API audience:\n\n```js\nawait server.register(require('fastify-jwt-jwks'), {\n  jwksUrl: '\u003cJWKS url\u003e',\n  audience: ['\u003capp audience\u003e', '\u003cadmin audience\u003e']\n})\n```\n\nYou can include [@fastify/jwt verify](https://github.com/fastify/fastify-jwt#verify) options:\n\n```js\nawait server.register(require('fastify-jwt-jwks'), {\n  jwksUrl: '\u003cJWKS url\u003e',\n  audience: ['\u003capp audience\u003e', '\u003cadmin audience\u003e'],\n  cache: true, // @fastify/jwt cache\n  cacheTTL: 100, // @fastify/jwt cache ttl\n  errorCacheTTL: -1 // @fastify/jwt error cache ttl\n})\n```\n\nYou can also use the `namespace` option to apply this plugin multiple times to the same Fastify instance, in order to perform JWT verification with different JWKs URLs:\n\n```js\nawait server.register(require('fastify-jwt-jwks'), {\n  jwksUrl: '\u003cJWKS url\u003e',\n  audience: '\u003capp audience\u003e'\n})\n\nawait server.register(require('fastify-jwt-jwks'), {\n  jwksUrl: '\u003cJWKS url 2\u003e',\n  audience: '\u003capp audience 2\u003e',\n  namespace: 'newToken'\n})\n\nserver.get('/verify',\n  {\n    preValidation: async function (request, reply) {\n      try {\n        await server.authenticate()\n      } catch (err) {\n        await server.newTokenAuthenticate()\n      }\n    }\n  },\n  (request, reply) =\u003e { reply.send(request.user) }\n)\n```\n\n## Contributing\n\nSee [CONTRIBUTING.md](./CONTRIBUTING.md)\n\n## Developer notes\n\n### Tests\n\nTests are currently split into **unit** and **integration** tests. \n\n## License\n\nCopyright NearForm Ltd. Licensed under the [Apache-2.0 license](http://www.apache.org/licenses/LICENSE-2.0).\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnearform%2Ffastify-jwt-jwks","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fnearform%2Ffastify-jwt-jwks","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnearform%2Ffastify-jwt-jwks/lists"}