secure-token-auth

An authentication library for Node.js + Express that allows you to generate and validate encrypted and signed tokens, with support for configurable expiration.

✨ Key Features

• 🔐 Encrypted token (AES-256-GCM)
• ✍️ Signed token (HMAC-SHA256)
• ⏱ Configurable expiration (1h, 30m, 3600)
• 🧩 Ready-to-use middleware for Express
• 🚫 No external dependencies (uses only Node's crypto)
• 📦 Simple and extensible API

📦 Installation

npm install secure-token-auth

or

yarn add secure-token-auth

🚀 Basic Usage

1️⃣ Creating the authentication instance

import { createAuth } from "secure-token-auth";

const auth = createAuth({
  secret: "my-super-secret-key",
  expiresIn: "1h" // also accepts seconds: 3600
});

2️⃣ Generating a token

const token = auth.generate({
  userId: 123,
  role: "admin"
});

console.log(token);

The generated token:

• Has creation date (iat)
• Has expiration date (exp)
• Has encrypted content
• Is immutable (signature)

3️⃣ Validating a token

try {
  const payload = auth.verify(token);
  console.log(payload);
} catch (err) {
  console.error(err.message);
}

If the token is valid, it returns only the original data (payload).

Possible errors:

• Token inválido (Invalid token)
• Assinatura inválida (Invalid signature)
• Token expirado (Token expired)

Express Example

import express from "express";
import { createAuth } from "secure-token-auth";

const app = express();

const auth = createAuth({
  secret: process.env.AUTH_SECRET,
  expiresIn: "2h"
});

app.get("/private", auth.middleware(), (req, res) => {
  res.json({
    message: "Access authorized",
    user: req.auth
  });
});

Fastify Example

import fastify from "fastify";
import { createAuth } from "secure-token-auth";

const app = fastify();

const auth = createAuth({
  secret: process.env.AUTH_SECRET,
  expiresIn: "2h"
});

const authHook = async (request, reply) => {
  const header = request.headers.authorization;
  if (!header) {
    reply.code(401);
    throw new Error("Token not provided");
  }

  const [, token] = header.split(" ");
  request.auth = auth.verify(token);
};

app.get(
  "/private",
  { preHandler: authHook },
  async (req) => {
    return { user: req.auth };
  }
);

📌 The middleware:

• Reads the Authorization: Bearer <token> header
• Validates and decrypts the token
• Injects data into req.auth
• Automatically returns 401 on error

⚙️ Available Configuration

createAuth(options)

| Option | Type | Required | Description | | ---------- | ------------------ | -------- | ---------------------------------------------- | | secret | string | ✅ | Key used for encryption and signing | | expiresIn | string \| number | ❌ | Expiration time (1h, 30m, 3600) |

Accepted formats for expiresIn

• "30s" → 30 seconds
• "15m" → 15 minutes
• "1h" → 1 hour
• "7d" → 7 days
• 3600 → seconds

Default: 1h