0.3.0 • Public • Published


CircleCI Test Coverage Maintainability npm version

JSON Web Token plugin for Serviceberry. For information about JSON Web Tokens see RFC 7519.


npm install serviceberry-jwt


Fails the request with a 401 Unauthorized status if the token is not found, is not formatted correctly, or if the key doesn't verify the signature.

This plugin exports an abstract class Jwt for extending by your authorization class that knows how to fetch your token keys. To use this plugin extend Jwt and implement at least getKey(id). The key is then used to verify the request's token. You can extend the validation by overriding validate(request) or change the process of finding a request's token by overriding getToken(request).

const Jwt = require("serviceberry-jwt");

class Auth extends Jwt {
	getKey (id) {
		return data.getKey(id); // can also return a promise or use async/await

	async validate (request) { // you can override validate to go beyond just verifying the token signature
		await super.validate(...arguments); // will throw if token is not verified
		... // test scopes or other custom payload properties

trunk.use(new Auth(verifyOptions, options));

verifyOptions object

See jsonwebtoken for verify options.

options object

  • scheme string

    The authentication scheme. Used to get the token from the request and to set the WWW-Authenticate response header scheme when responding with 401 Unauthorized. Defaults to Bearer.

    • Bearer

      When the scheme is Bearer the plugin will look for the token in the request's Authorization header.

    • Token

      When the scheme is Token the plugin will look for the token in the request's parameters by it's name (see param below). request.getParam(options.param).

  • accessToken boolean

    When scheme is Bearer and accessToken is true, first look for the token in the Authorization header and if it isn't found look for access_token as described below. Defaults to false. This option has no purpose if scheme is Token. Per RFC 6750 sections 2.2 & 2.3.

    • Find bearer token in a form encoded body parameter named access_token for request methods with defined body semantics (POST, PUT, and PATCH).

    • Find bearer token in a query string parameter named access_token for request methods without defined body semantics (not POST, PUT, or PATCH).

  • param string

    When scheme is Token, param is the name of the request parameter where the token should be found. Defaults to token. This can be any type of request parameter - path, query string, or body. This option has no purpose if scheme is Bearer.


Abstract class

constructor([verifyOptions[, options]])

  • verifyOptions object

    Sets this.verifyOptions. Passed to jwt.verify(). See jsonwebtoken

  • options

    Sets this.options. See options above.


You must extend this class and at least implement this method.

Called by the validate method for fetching a signing key used to verify a token.

  • id string

    The id which identifies the key to be used to verify the token.

use(request, response)

The handler method. This is the method called by Serviceberry. Sets request.jwt. This is an async function.

  • request object

    Serviceberry request object.

  • response object

    Serviceberry response object.


Called by the use method to validate the token. This is an async function and should return or resolve to a boolean value or throw an error.

  • request object

    Serviceberry request object.


Called by the use method to find the request's token.

  • request object

    Serviceberry request object.

Package Sidebar


npm i serviceberry-jwt

Weekly Downloads






Unpacked Size

10.9 kB

Total Files


Last publish


  • bob-gray