How do you implement JWT authentication in a Node.js API?

Question

Accepted Answer

**JWT (JSON Web Token)** — stateless authentication using signed tokens.

**Implementation:**
```javascript
const jwt = require("jsonwebtoken");
const SECRET = process.env.JWT_SECRET;

// Generate token on login
function generateToken(user) {
    return jwt.sign(
        { id: user.id, role: user.role },
        SECRET,
        { expiresIn: "24h" }
    );
}

// Middleware to verify token
function authMiddleware(req, res, next) {
    const token = req.headers.authorization?.split(" ")[1];
    if (!token) return res.status(401).json({ error: "No token" });

try {
        const decoded = jwt.verify(token, SECRET);
        req.user = decoded;
        next();
    } catch (err) {
        res.status(401).json({ error: "Invalid token" });
    }
}

app.post("/login", async (req, res) => {
    const user = await authenticateUser(req.body);
    if (!user) return res.status(401).json({ error: "Bad credentials" });
    const token = generateToken(user);
    res.json({ token });
});

app.get("/protected", authMiddleware, (req, res) => {
    res.json({ message: "Hello " + req.user.id });
});
```

**Security tips:**
- Store secret in env variables.
- Use short expiration times.
- Implement refresh tokens.
- Never store JWT in localStorage for web apps.

Node.js: How do you implement JWT authentication in a Node.js API?