auth0-fastify-api

Protect Fastify API endpoints with Auth0 JWT validation.

23|71|Updated Jul 8, 2025
One-click install
npx skills add https://github.com/auth0/docs-v2 --skill auth0-fastify-api
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: auth0-fastify-api
Source: https://github.com/auth0/docs-v2/tree/main/main/.mintlify/skills/auth0-fastify-api
Command: npx skills add https://github.com/auth0/docs-v2 --skill auth0-fastify-api

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill stops unauthorized access to Fastify API routes by validating JWT bearer tokens and ensuring only properly scoped requests reach the business logic.

Core Features & Use Cases

  • JWT validation middleware: register @auth0/auth0-fastify-api to decode tokens, attach user claims, and block invalid requests before route handlers run.
  • Scope and permission checks: call fastify.requireAuth with specific scopes or permission lists to enforce API-level authorization per endpoint.
  • Use Case: Protect a RESTful Fastify backend serving mobile and SPA clients by requiring access tokens with the correct audience so that only authorized users can hit protected routes.

Quick Start

Register the @auth0/auth0-fastify-api plugin with your Fastify server, set AUTH0_DOMAIN and AUTH0_AUDIENCE from your Auth0 API, and protect routes using fastify.requireAuth().

Frequently Asked Questions about auth0-fastify-api

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I protect Fastify API routes with Auth0 JWT validation?

Protect Fastify API routes by registering the Auth0 plugin to validate JWT bearer tokens, attach user claims, and block invalid requests before route handlers run. Use fastify.requireAuth preHandlers to enforce stateless authentication on endpoints.

How do I enforce scope and permission checks on Node.js Fastify endpoints?

Enforce scope and permission checks on Node.js Fastify endpoints by calling fastify.requireAuth with specific scopes or permission lists. This validates access tokens against your Auth0 API audience to ensure only properly scoped requests reach business logic.

Do I need an Auth0 API resource and audience to secure a Fastify backend?

Yes, securing a Fastify backend requires an Auth0 API resource and matching audience configuration. You must set AUTH0_DOMAIN and AUTH0_AUDIENCE so the JWT validation middleware can verify access tokens from SPA and mobile clients.

Can I use this JWT validation middleware for stateless auth in Fastify REST APIs?

Yes, you can use this JWT validation middleware for stateless auth in Fastify REST APIs. It decodes bearer tokens, attaches user claims, and applies fastify.requireAuth preHandlers to protect routes without server-side sessions.

What's the best way to secure a Fastify backend serving SPA and mobile clients?

The best way to secure a Fastify backend serving SPA and mobile clients is requiring access tokens with the correct Auth0 audience. Register the Auth0 Fastify plugin to validate JWTs and block unauthorized users from hitting protected routes.