jwt-auth

Issue short-lived access tokens and rotating refresh tokens in httpOnly cookies.

Updated Jan 30, 2026

Search Tags:#typescript #security #authentication #python #jwt #node #refresh-token

Ready to run

npx skills add https://github.com/jrmatherly/metorial-workspace --skill jwt-auth

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: jwt-auth
Source: https://github.com/jrmatherly/metorial-workspace/tree/main/.github/skills/jwt-auth
Command: npx skills add https://github.com/jrmatherly/metorial-workspace --skill jwt-auth

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Enable secure, stateless authentication for SPAs, mobile apps, and APIs by issuing short-lived access tokens and rotatable refresh tokens.

Core Features & Use Cases

Token Rotation: One-time-use refresh tokens with rotation to detect token theft.
Secure Storage: Access tokens kept in memory and refresh tokens stored in httpOnly cookies.
Cross-Platform: Supports TypeScript/JavaScript and Python backends for seamless integration.

Quick Start

Use the jwt-auth skill to enable secure authentication with refresh token rotation in your app.

Frequently Asked Questions about jwt-auth

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How does refresh token rotation improve JWT authentication security?▼

You should use JWT authentication with refresh token rotation for SPAs, mobile apps, and APIs requiring stateless authentication with automatic token renewal. It issues short-lived access tokens and rotates refresh tokens to maintain secure, continuous user sessions.

How do I securely store JWT access and refresh tokens in a web application?▼

You can secure JWT tokens by keeping the short-lived access token in application memory and storing the rotatable refresh token in an httpOnly cookie. This approach mitigates XSS-based token theft while supporting automatic session renewal.

Does this JWT authentication approach work with both Python and TypeScript backends?▼

Yes, this JWT authentication implementation supports both TypeScript/JavaScript and Python backends. It provides token creation, rotation, storage in httpOnly cookies, and verification capabilities seamlessly across these distinct backend environments.

What is the best way to implement stateless authentication for a modern API?▼

The best way to implement stateless authentication for modern APIs is to issue short-lived JWT access tokens and rotate refresh tokens. This approach maintains secure stateless verification while enabling automatic token renewal for active sessions.

Why do I need short-lived access tokens for SPA authentication?▼

You need short-lived access tokens for SPA authentication to minimize the impact window if a token is compromised. Pairing them with rotatable refresh tokens stored in httpOnly cookies ensures secure, automatic session renewal without persistent exposure.