Node.js API Authentication Guide

🔐 Node.js API Authentication Guide (Complete Guide)

Authentication is a critical part of any API—it ensures that only authorized users can access protected resources.

This guide covers:

✅ Password hashing
✅ JWT Authentication
✅ Login & Register
✅ Protected routes
✅ Middleware
✅ Best practices

We will use:

Node.js
Express.js
bcryptjs (Password hashing)
jsonwebtoken (JWT)

📦 1. Setup Project

Install required packages:

🧱 2. Basic Server Setup

server.js

🔐 3. Password Hashing with bcryptjs

Before saving passwords — always hash them!

Verify password:

🧩 4. User Data (Demo)

In real apps, use MongoDB/MySQL.

Here, we use an array:

🆕 5. Register Route

const bcrypt = require('bcryptjs');

app.post('/api/register', async (req, res) => {
const { name, email, password } = req.body;

// Check already exists
const exists = users.find(u => u.email === email);
if (exists) return res.status(400).json({ message: 'Email already registered' });

// Hash password
const hashedPassword = await bcrypt.hash(password, 10);

const newUser = {
id: Date.now(),
name,
email,
password: hashedPassword
};

users.push(newUser);

res.status(201).json({ message: 'User registered successfully' });
});

const bcrypt = require('bcryptjs');

app.post('/api/register', async (req, res) => {

const { name, email, password } = req.body;

// Check already exists

const exists = users.find(u => u.email === email);

if (exists) return res.status(400).json({ message: 'Email already registered' });

// Hash password

const hashedPassword = await bcrypt.hash(password, 10);

const newUser = {

id: Date.now(),

name,

email,

password: hashedPassword

};

users.push(newUser);

res.status(201).json({ message: 'User registered successfully' });

});

🔑 6. Login Route (JWT Token Generation)

Install JWT if not installed:

Create JWT secret key:

Login API:

app.post('/api/login', async (req, res) => {
const { email, password } = req.body;

const user = users.find(u => u.email === email);
if (!user) return res.status(400).json({ message: 'Invalid email or password' });

const isMatch = await bcrypt.compare(password, user.password);
if (!isMatch) return res.status(400).json({ message: 'Invalid email or password' });

// Create token
const token = jwt.sign(
{ id: user.id, email: user.email },
JWT_SECRET,
{ expiresIn: '1h' }
);

res.json({ message: 'Login successful', token });
});

app.post('/api/login', async (req, res) => {

const { email, password } = req.body;

const user = users.find(u => u.email === email);

if (!user) return res.status(400).json({ message: 'Invalid email or password' });

const isMatch = await bcrypt.compare(password, user.password);

if (!isMatch) return res.status(400).json({ message: 'Invalid email or password' });

// Create token

const token = jwt.sign(

{ id: user.id, email: user.email },

JWT_SECRET,

{ expiresIn: '1h' }

);

res.json({ message: 'Login successful', token });

});

🛡️ 7. JWT Authentication Middleware (Protect Routes)

Create middleware:

function authMiddleware(req, res, next) {
const token = req.headers['authorization'];

if (!token) return res.status(401).json({ message: 'Access Denied: No Token Provided' });

try {
const verified = jwt.verify(token, JWT_SECRET);
req.user = verified; // store user info
next();
} catch (err) {
return res.status(401).json({ message: 'Invalid Token' });
}
}

function authMiddleware(req, res, next) {

const token = req.headers['authorization'];

if (!token) return res.status(401).json({ message: 'Access Denied: No Token Provided' });

try {

const verified = jwt.verify(token, JWT_SECRET);

req.user = verified; // store user info

next();

} catch (err) {

return res.status(401).json({ message: 'Invalid Token' });

}

🔒 8. Protected Route

Only logged-in users can access this route:

Test with:

📘 9. Logout (Client-Side)

JWT is stateless → logout is handled by frontend:

Delete token from localStorage / cookies
Server doesn’t need to store sessions

(Optional) Block tokens via blacklist for advanced systems.

🧰 10. Full Example Code (server.js)

const express = require('express');
const bcrypt = require('bcryptjs');
const jwt = require('jsonwebtoken');

const app = express();
app.use(express.json());

const JWT_SECRET = 'mysecretkey123';
let users = [];

// REGISTER
app.post('/api/register', async (req, res) => {
const { name, email, password } = req.body;
const exists = users.find(u => u.email === email);
if (exists) return res.status(400).json({ message: 'Email already registered' });

const hashedPassword = await bcrypt.hash(password, 10);

const newUser = {
id: Date.now(),
name,
email,
password: hashedPassword
};

users.push(newUser);
res.status(201).json({ message: 'User registered successfully' });
});

// LOGIN
app.post('/api/login', async (req, res) => {
const { email, password } = req.body;
const user = users.find(u => u.email === email);
if (!user) return res.status(400).json({ message: 'Invalid email or password' });

const isMatch = await bcrypt.compare(password, user.password);
if (!isMatch) return res.status(400).json({ message: 'Invalid email or password' });

const token = jwt.sign({ id: user.id, email: user.email }, JWT_SECRET, { expiresIn: '1h' });
res.json({ message: 'Login successful', token });
});

// AUTH MIDDLEWARE
function authMiddleware(req, res, next) {
const token = req.headers['authorization'];
if (!token) return res.status(401).json({ message: 'Access Denied: No Token Provided' });

try {
const verified = jwt.verify(token, JWT_SECRET);
req.user = verified;
next();
} catch (err) {
return res.status(401).json({ message: 'Invalid Token' });
}
}

// PROTECTED ROUTE
app.get('/api/profile', authMiddleware, (req, res) => {
res.json({ message: 'Profile Access Granted', user: req.user });
});

app.listen(3000, () => console.log('Server running on port 3000'));

const express = require('express');

const bcrypt = require('bcryptjs');

const jwt = require('jsonwebtoken');

const app = express();

app.use(express.json());

const JWT_SECRET = 'mysecretkey123';

let users = [];

// REGISTER

app.post('/api/register', async (req, res) => {

const { name, email, password } = req.body;

const exists = users.find(u => u.email === email);

if (exists) return res.status(400).json({ message: 'Email already registered' });

const hashedPassword = await bcrypt.hash(password, 10);

const newUser = {

id: Date.now(),

name,

email,

password: hashedPassword

};

users.push(newUser);

res.status(201).json({ message: 'User registered successfully' });

});

// LOGIN

app.post('/api/login', async (req, res) => {

const { email, password } = req.body;

const user = users.find(u => u.email === email);

if (!user) return res.status(400).json({ message: 'Invalid email or password' });

const isMatch = await bcrypt.compare(password, user.password);

if (!isMatch) return res.status(400).json({ message: 'Invalid email or password' });

const token = jwt.sign({ id: user.id, email: user.email }, JWT_SECRET, { expiresIn: '1h' });

res.json({ message: 'Login successful', token });

});

// AUTH MIDDLEWARE

function authMiddleware(req, res, next) {

const token = req.headers['authorization'];

if (!token) return res.status(401).json({ message: 'Access Denied: No Token Provided' });

try {

const verified = jwt.verify(token, JWT_SECRET);

req.user = verified;

next();

} catch (err) {

return res.status(401).json({ message: 'Invalid Token' });

}

// PROTECTED ROUTE

app.get('/api/profile', authMiddleware, (req, res) => {

res.json({ message: 'Profile Access Granted', user: req.user });

});

app.listen(3000, () => console.log('Server running on port 3000'));

🛑 11. Authentication Best Practices (Highly Recommended)

✔ Never store passwords — always hash
✔ Use dotenv for secrets
✔ Set token expiry (1h recommended)
✔ Use HTTPS in production
✔ Validate email/password inputs
✔ Use refresh tokens for long sessions
✔ Use role-based access control (RBAC) for admin access

Node.js API Authentication Guide

🔐 Node.js API Authentication Guide (Complete Guide)

📦 1. Setup Project

🧱 2. Basic Server Setup

🔐 3. Password Hashing with bcryptjs

🧩 4. User Data (Demo)

🆕 5. Register Route

🔑 6. Login Route (JWT Token Generation)

Login API:

🛡️ 7. JWT Authentication Middleware (Protect Routes)

🔒 8. Protected Route

📘 9. Logout (Client-Side)

🧰 10. Full Example Code (server.js)

🛑 11. Authentication Best Practices (Highly Recommended)

You may also like...

Node.js Tutorials

Asynchronous

Module Basics

Core Modules

Building Applications

Node.js Advanced

Node.js Database Integration

Node.js Deployment

Node.js Advanced Communication

Node.js and Raspberry Pi

Node.js Perfomance & Scaling

Node.js Testing & Debugging

Node.js API Authentication Guide

🔐 Node.js API Authentication Guide (Complete Guide)

📦 1. Setup Project

🧱 2. Basic Server Setup

🔐 3. Password Hashing with bcryptjs

🧩 4. User Data (Demo)

🆕 5. Register Route

🔑 6. Login Route (JWT Token Generation)

Login API:

🛡️ 7. JWT Authentication Middleware (Protect Routes)

🔒 8. Protected Route

📘 9. Logout (Client-Side)

🧰 10. Full Example Code (server.js)

🛑 11. Authentication Best Practices (Highly Recommended)

You may also like...

Node.js Express.js

Node.js RESTful API

Node.js Middleware

Node.js Tutorials

Asynchronous

Module Basics

Core Modules

Building Applications

Node.js Advanced

Node.js Database Integration

Node.js Deployment

Node.js Advanced Communication

Node.js and Raspberry Pi

Node.js Perfomance & Scaling

Node.js Testing & Debugging