Loading page
by Kai
Express.js authentication backend with JWT-based access tokens, refresh token rotation, and role-based access control. Features asymmetric RS256 signing with JWKS endpoint, SQLite persistence, device fingerprinting, and automatic cleanup of expired tokens. Includes registration, login, session management, and admin-only endpoints—ready to integrate with TypeScript applications requiring enterprise-grade auth.
TetreesAI backend API — a production-ready authentication and session management service built with Express.js and TypeScript. Features JWT-based access tokens with asymmetric RS256 signing, refresh token rotation, role-based access control (RBAC), device fingerprinting, and automatic cleanup of expired tokens.
/api/health endpoint for monitoringnpm install
npm run build
npm start
The server listens on port 9019 by default.
npm run dev
| Variable | Description | Default |
|---|---|---|
PORT | Server port | 9019 |
POST /api/auth/registerRegister a new user account.
Request:
{
"email": "user@example.com",
"password": "SecureP@ss123",
"roles": ["user"]
}
Response:
{
"data": {
"user": { "id": "uuid", "email": "user@example.com", "roles": ["user"] },
"access_token": "eyJhbGc...",
"refresh_token": "a1b2c3d4..."
}
}
POST /api/auth/loginAuthenticate user and receive token pair.
Request:
{
"email": "user@example.com",
"password": "SecureP@ss123"
}
Response: Same as register endpoint.
POST /api/auth/token/refreshRotate refresh token to obtain new access/refresh pair.
Request:
{
"refresh_token": "a1b2c3d4..."
}
Response:
{
"data": {
"access_token": "eyJhbGc...",
"refresh_token": "f6a1b2c3..."
}
}
POST /api/auth/token/revokeRevoke specific tokens or all user sessions. Requires Authorization: Bearer <access_token> header.
Request (revoke all):
{
"revoke_all": true
}
Request (revoke specific refresh token):
{
"refresh_token": "a1b2c3d4..."
}
Response:
{
"data": {
"message": "All tokens revoked"
}
}
POST /api/auth/logoutLogout current session. Blacklists access token and optionally revokes refresh token. Requires Authorization: Bearer <access_token> header.
Request:
{
"refresh_token": "a1b2c3d4..."
}
Response:
{
"data": {
"message": "Logged out successfully"
}
}
GET /api/auth/meGet authenticated user profile. Requires Authorization: Bearer <access_token> header.
Response:
{
"data": {
"id": "uuid",
"email": "user@example.com",
"roles": ["user"]
}
}
GET /api/auth/sessionsList all active sessions for authenticated user. Requires Authorization: Bearer <access_token> header.
Response:
{
"data": {
"sessions": [
{
"id": "session-uuid",
"device_fingerprint": "abc123def456",
"created_at": "2025-01-15T08:00:00.000Z",
"last_used_at": "2025-01-15T10:30:00.000Z"
}
]
}
}
GET /api/auth/jwksReturns JSON Web Key Set for token verification.
Response:
{
"keys": [
{
"kty": "RSA",
"kid": "primary",
"use": "sig",
"alg": "RS256",
"n": "0vx7agoebGcQ...",
"e": "AQAB"
}
]
}
GET /api/auth/publicPublic endpoint (no authentication required).
Response:
{
"data": {
"message": "This is a public endpoint"
}
}
GET /api/auth/admin-onlyProtected endpoint for admin role only. Requires Authorization: Bearer <access_token> header with admin role.
Response:
{
"data": {
"message": "Welcome, admin"
}
}
GET /api/healthHealth check endpoint.
Response:
{
"data": {
"status": "ok",
"timestamp": "2025-01-15T10:30:00.000Z"
}
}
POST /api/admin/cleanupTrigger immediate cleanup of expired tokens and revoked sessions.
Response:
{
"data": {
"expired_tokens_removed": 3,
"revoked_sessions_removed": 1,
"blacklisted_tokens_removed": 2,
"timestamp": "2025-01-15T10:30:00.000Z"
}
}
Spin up an isolated sandbox and run it server-side — no local setup.
The sandbox audition completed and the detected runnable path passed.
This Express backend / api completed archive review with strong static results. Structure, dependency manifests, documentation, functional source, and common risk patterns were checked by the Tetrees verification pipeline; runtime phases are stated separately.
Deterministic AVCP artifact review
Pipeline avcp-2026-08-04.1 · SHA-256 afb7953f4cf36ad5…
This version-scoped review deterministically inspects the submitted archive for structure, dependencies, documentation, functional source, and common malicious or high-risk signals. Build and test phases are reported as passed only after an isolated sandbox audition. It is not a guarantee of perfect security.
Reviewed Aug 4, 2026
The full install guide and integration prompts unlock after purchase.
Push this product straight into your AI IDE, web builder or cloud IDE.
Download your licensed source snapshot from the library, then follow the setup guide in your workspace.
25 ratings
Dropped it into my stack and it just worked. Picked up this automation setup for a client workflow — No spaghetti — the folder layout is sane. Five stars, would recommend to my team.
Better than I expected. Picked up "Backend JWT Login Module" for a client workflow — Handles the edge cases I usually have to patch myself.
This is a keeper. TypeScript types are actually accurate, no fighting the compiler, and docs were clear enough that I never had to open an issue. Minor tweaks needed for my use case but nothing broke.
Genuinely impressed. Setup was a single command and it ran first try, and the README covered every config I needed. Minor tweaks needed for my use case but nothing broke.
Shipped with this same week. Picked up "Backend JWT Login Module" for a client workflow — No spaghetti — the folder layout is sane. Docking half a star only because I wanted a couple more examples.
Rock solid so far. Handles the edge cases I usually have to patch myself, and docs were clear enough that I never had to open an issue. Docking half a star only because I wanted a couple more examples.
Saved me a ton of time. Picked up "Backend JWT Login Module" for a client workflow — Components are cleanly separated and easy to extend. Will definitely check their other products.
Better than I expected. As someone who automates these all day, no spaghetti — the folder layout is sane.
Clean and well thought out. Dropped this automation setup straight into the workflow; the README covered every config I needed.
Punches well above its price. Dropped this automation setup straight into the workflow; the walkthrough got me running in minutes.
Sign in to join the discussion
Loading discussion…