Node.js API Authentication Guide

🔐 Node.js API Authentication Guide (Complete Guide)

Authentication is a critical part of any API—it ensures that only authorized users can access protected resources.

This guide covers:

✅ Password hashing
✅ JWT Authentication
✅ Login & Register
✅ Protected routes
✅ Middleware
✅ Best practices

We will use:

Node.js
Express.js
bcryptjs (Password hashing)
jsonwebtoken (JWT)

📦 1. Setup Project

Install required packages:

🧱 2. Basic Server Setup

server.js

const express = require('express');
const app = express();

app.use(express.json());

app.get('/', (req, res) => {
res.send('Authentication API is running...');
});

app.listen(3000, () => console.log('Server running on port 3000'));

const express = require('express');

const app = express();

app.use(express.json());

app.get('/', (req, res) => {

res.send('Authentication API is running...');

});

app.listen(3000, () => console.log('Server running on port 3000'));

🔐 3. Password Hashing with bcryptjs

Before saving passwords — always hash them!

Verify password:

🧩 4. User Data (Demo)

In real apps, use MongoDB/MySQL.

Here, we use an array:

🆕 5. Register Route

const bcrypt = require('bcryptjs');

app.post('/api/register', async (req, res) => {
const { name, email, password } = req.body;

// Check already exists
const exists = users.find(u => u.email === email);
if (exists) return res.status(400).json({ message: 'Email already registered' });

// Hash password
const hashedPassword = await bcrypt.hash(password, 10);

const newUser = {
id: Date.now(),
name,
email,
password: hashedPassword
};

users.push(newUser);

res.status(201).json({ message: 'User registered successfully' });
});

const bcrypt = require('bcryptjs');

app.post('/api/register', async (req, res) => {

const { name, email, password } = req.body;

// Check already exists

const exists = users.find(u => u.email === email);

if (exists) return res.status(400).json({ message: 'Email already registered' });

// Hash password

const hashedPassword = await bcrypt.hash(password, 10);

const newUser = {

id: Date.now(),

name,

email,

password: hashedPassword

};

users.push(newUser);

res.status(201).json({ message: 'User registered successfully' });

});

🔑 6. Login Route (JWT Token Generation)

Install JWT if not installed:

Create JWT secret key:

Login API:

app.post('/api/login', async (req, res) => {
const { email, password } = req.body;

const user = users.find(u => u.email === email);
if (!user) return res.status(400).json({ message: 'Invalid email or password' });

const isMatch = await bcrypt.compare(password, user.password);
if (!isMatch) return res.status(400).json({ message: 'Invalid email or password' });

// Create token
const token = jwt.sign(
{ id: user.id, email: user.email },
JWT_SECRET,
{ expiresIn: '1h' }
);

res.json({ message: 'Login successful', token });
});

app.post('/api/login', async (req, res) => {

const { email, password } = req.body;

const user = users.find(u => u.email === email);

if (!user) return res.status(400).json({ message: 'Invalid email or password' });

const isMatch = await bcrypt.compare(password, user.password);

if (!isMatch) return res.status(400).json({ message: 'Invalid email or password' });

// Create token

const token = jwt.sign(

{ id: user.id, email: user.email },

JWT_SECRET,

{ expiresIn: '1h' }

);

res.json({ message: 'Login successful', token });

});

🛡️ 7. JWT Authentication Middleware (Protect Routes)

Create middleware:

function authMiddleware(req, res, next) {
const token = req.headers['authorization'];

if (!token) return res.status(401).json({ message: 'Access Denied: No Token Provided' });

try {
const verified = jwt.verify(token, JWT_SECRET);
req.user = verified; // store user info
next();
} catch (err) {
return res.status(401).json({ message: 'Invalid Token' });
}
}

function authMiddleware(req, res, next) {

const token = req.headers['authorization'];

if (!token) return res.status(401).json({ message: 'Access Denied: No Token Provided' });

try {

const verified = jwt.verify(token, JWT_SECRET);

req.user = verified; // store user info

next();

} catch (err) {

return res.status(401).json({ message: 'Invalid Token' });

}

🔒 8. Protected Route

Only logged-in users can access this route:

Test with:

📘 9. Logout (Client-Side)

JWT is stateless → logout is handled by frontend:

Delete token from localStorage / cookies
Server doesn’t need to store sessions

(Optional) Block tokens via blacklist for advanced systems.

🧰 10. Full Example Code (server.js)

const express = require('express');
const bcrypt = require('bcryptjs');
const jwt = require('jsonwebtoken');

const app = express();
app.use(express.json());

const JWT_SECRET = 'mysecretkey123';
let users = [];

// REGISTER
app.post('/api/register', async (req, res) => {
const { name, email, password } = req.body;
const exists = users.find(u => u.email === email);
if (exists) return res.status(400).json({ message: 'Email already registered' });

const hashedPassword = await bcrypt.hash(password, 10);

const newUser = {
id: Date.now(),
name,
email,
password: hashedPassword
};

users.push(newUser);
res.status(201).json({ message: 'User registered successfully' });
});

// LOGIN
app.post('/api/login', async (req, res) => {
const { email, password } = req.body;
const user = users.find(u => u.email === email);
if (!user) return res.status(400).json({ message: 'Invalid email or password' });

const isMatch = await bcrypt.compare(password, user.password);
if (!isMatch) return res.status(400).json({ message: 'Invalid email or password' });

const token = jwt.sign({ id: user.id, email: user.email }, JWT_SECRET, { expiresIn: '1h' });
res.json({ message: 'Login successful', token });
});

// AUTH MIDDLEWARE
function authMiddleware(req, res, next) {
const token = req.headers['authorization'];
if (!token) return res.status(401).json({ message: 'Access Denied: No Token Provided' });

try {
const verified = jwt.verify(token, JWT_SECRET);
req.user = verified;
next();
} catch (err) {
return res.status(401).json({ message: 'Invalid Token' });
}
}

// PROTECTED ROUTE
app.get('/api/profile', authMiddleware, (req, res) => {
res.json({ message: 'Profile Access Granted', user: req.user });
});

app.listen(3000, () => console.log('Server running on port 3000'));

const express = require('express');

const bcrypt = require('bcryptjs');

const jwt = require('jsonwebtoken');

const app = express();

app.use(express.json());

const JWT_SECRET = 'mysecretkey123';

let users = [];

// REGISTER

app.post('/api/register', async (req, res) => {

const { name, email, password } = req.body;

const exists = users.find(u => u.email === email);

if (exists) return res.status(400).json({ message: 'Email already registered' });

const hashedPassword = await bcrypt.hash(password, 10);

const newUser = {

id: Date.now(),

name,

email,

password: hashedPassword

};

users.push(newUser);

res.status(201).json({ message: 'User registered successfully' });

});

// LOGIN

app.post('/api/login', async (req, res) => {

const { email, password } = req.body;

const user = users.find(u => u.email === email);

if (!user) return res.status(400).json({ message: 'Invalid email or password' });

const isMatch = await bcrypt.compare(password, user.password);

if (!isMatch) return res.status(400).json({ message: 'Invalid email or password' });

const token = jwt.sign({ id: user.id, email: user.email }, JWT_SECRET, { expiresIn: '1h' });

res.json({ message: 'Login successful', token });

});

// AUTH MIDDLEWARE

function authMiddleware(req, res, next) {

const token = req.headers['authorization'];

if (!token) return res.status(401).json({ message: 'Access Denied: No Token Provided' });

try {

const verified = jwt.verify(token, JWT_SECRET);

req.user = verified;

next();

} catch (err) {

return res.status(401).json({ message: 'Invalid Token' });

}

// PROTECTED ROUTE

app.get('/api/profile', authMiddleware, (req, res) => {

res.json({ message: 'Profile Access Granted', user: req.user });

});

app.listen(3000, () => console.log('Server running on port 3000'));

🛑 11. Authentication Best Practices (Highly Recommended)

✔ Never store passwords — always hash
✔ Use dotenv for secrets
✔ Set token expiry (1h recommended)
✔ Use HTTPS in production
✔ Validate email/password inputs
✔ Use refresh tokens for long sessions
✔ Use role-based access control (RBAC) for admin access

Node.js API Authentication Guide

🔐 Node.js API Authentication Guide (Complete Guide)

📦 1. Setup Project

🧱 2. Basic Server Setup

🔐 3. Password Hashing with bcryptjs

🧩 4. User Data (Demo)

🆕 5. Register Route

🔑 6. Login Route (JWT Token Generation)

Login API:

🛡️ 7. JWT Authentication Middleware (Protect Routes)

🔒 8. Protected Route

📘 9. Logout (Client-Side)

🧰 10. Full Example Code (server.js)

🛑 11. Authentication Best Practices (Highly Recommended)

You may also like...

Node.js Tutorials

Node.js API Authentication Guide

🔐 Node.js API Authentication Guide (Complete Guide)

📦 1. Setup Project

🧱 2. Basic Server Setup

🔐 3. Password Hashing with bcryptjs

🧩 4. User Data (Demo)

🆕 5. Register Route

🔑 6. Login Route (JWT Token Generation)

Login API:

🛡️ 7. JWT Authentication Middleware (Protect Routes)

🔒 8. Protected Route

📘 9. Logout (Client-Side)

🧰 10. Full Example Code (server.js)

🛑 11. Authentication Best Practices (Highly Recommended)

You may also like...

Node.js Frameworks

Node.js with Frontend Frameworks

Node.js RESTful API

Node.js Tutorials