Passage makes it easy to associate an HTTP request with an authenticated user. The following code can be used to validate that a request was made by an authenticated user.
import Passage from"@passageidentity/passage-node";// Passage requires an App ID and, optionally, an API KeyconstpassageConfig= { appID:process.env.PASSAGE_APP_ID, apiKey:process.env.PASSAGE_API_KEY,};// Authentication using Passage class instancelet passage =newPassage(passageConfig);app.get("/authenticatedRoute",async(req, res) => {try {// Authenticate request using Passagelet userID =awaitpassage.authenticateRequest(req);if (userID) {// User is authenticatedlet userData =awaitpassage.user.get(userID);console.log(userData); } } catch (e) {// Authentication failedconsole.log(e);res.send("Authentication failed!"); }});
constPassage=require("@passageidentity/passage-node");// Passage requires an App ID and, optionally, an API KeyconstpassageConfig= { appID:process.env.PASSAGE_APP_ID, apiKey:process.env.PASSAGE_API_KEY,};// Authentication using Passage class instancelet passage =newPassage(passageConfig);app.get("/authenticatedRoute",async(req, res) => {try {// Authenticate request using Passagelet userID =awaitpassage.authenticateRequest(req);if (userID) {// User is authenticatedlet userData =awaitpassage.user.get(userID);console.log(userData); } } catch (e) {// Authentication failedconsole.log(e);res.send("Authentication failed!"); }});
By default, Passage looks for the user JWT from a cookie that is set by the Passage Element ( psg_auth_token ). If your application uses Authorization headers instead, you can pass the following option to the Passage Node SDK.
Authenticating a Request With Express.js Middleware
If you use Express.js, Passage provides a middleware that can be used directly. This middleware will authenticate a request and return a 401 Unauthorized if the token is invalid. If it succeeds, the Passage User ID will be available in the response. The following code shows how the Passage middleware can be used in an Express.js application.
import Passage from"@passageidentity/passage-node";constpassageConfig= { appID:process.env.PASSAGE_APP_ID, apiKey:process.env.PASSAGE_API_KEY,};// example of passage middlewarelet passage =newpsg(passageConfig);let passageAuthMiddleware = (() => {returnasync (req, res, next) => {try {let userID =awaitpassage.authenticateRequest(req);if (userID) {// user authenticatedres.userID = userID; next(); } } catch(e) {// failed to authenticate// we recommend returning a 401 or other "unauthorized" behaviorconsole.log(e);res.status(401).send('Could not authenticate user!'); } }})();app.get("/authenticatedRoute", passageAuthMiddleware,async(req, res) => {let userID =res.userID// do authenticated things... });
If you are not using passage-node in a request context, or your application is passing the JWT in a custom way, you can pass the JWT directly to the validAuthToken method to perform validation.
In addition to authenticating requests, the Passage Node SDK also provides a way to securely manage your users. These functions require authentication using a Passage API key. API keys can be managed in the Passage Console.
The functionality currently available on a user is:
Get a user's information (including any defined user metadata)
Activate or deactivate a user (a deactivated user will not be able to log in)
Update a user's information (email address or phone number)
Delete a user
Create a user
Passage API Keys are sensitive! You should store them securely along with your other application secrets.
The Node.js SDK can be used to generate custom magic links for users, that can be embedded into any content medium. To learn more, see our full guide on Embedded Magic Links.