jwt-auth

Implement JWT authentication with bcrypt password hashing and token rotation for secure sessions.

Updated Jan 17, 2026

Search Tags:#security #authentication #jwt #rate-limiting #bcrypt #token #web-api

Ready to run

npx skills add https://github.com/linsomniac/smtphotel --skill jwt-auth-linsomniac

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: jwt-auth
Source: https://github.com/linsomniac/smtphotel/tree/main/.claude/skills/jwt-auth
Command: npx skills add https://github.com/linsomniac/smtphotel --skill jwt-auth-linsomniac

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill provides a secure, scalable JWT-based authentication framework enabling login, registration, token handling, and password management for apps.

Core Features & Use Cases

JWT-based access and refresh token handling with rotation
Password hashing and verification using bcrypt
Token signing and verification tokens for secure recipient workflows
Rate-limited authentication flow with security best practices

Quick Start

Integrate the JWT authentication utilities into your app's login flow to enable secure access and refresh token handling.

Frequently Asked Questions about jwt-auth

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I implement JWT-based authentication with refresh token rotation for a web API?▼

JWT-based authentication issues short-lived access tokens and uses refresh token rotation to maintain secure, stateless user sessions across web APIs. This approach pairs bcrypt password hashing with token validation to prevent unauthorized access.

What's the best way to handle bcrypt password hashing during user registration and login?▼

Bcrypt password hashing secures user credentials during registration and login by applying a salted hash to plaintext passwords before storage. The authentication flow then verifies the provided password against the stored bcrypt hash during login.

Does this JWT authentication approach support rate-limiting for login and password reset flows?▼

JWT authentication applies rate-limiting to login, registration, and password reset flows to prevent brute-force attacks and abuse. Rate limits are integrated directly into the token issuance and validation services to enforce security best practices.

How do I create and revoke JWT tokens for secure password reset workflows?▼

Creating and revoking JWT tokens for password reset workflows involves generating signed, short-lived verification tokens and revoking them upon successful password update. This ensures only valid recipients can trigger the reset process.

Can I use JWT access and refresh tokens for stateless authentication across multiple web applications?▼

JWT access and refresh tokens enable stateless authentication across multiple web applications by encoding user identity within signed tokens. The server validates the token signature without storing session state, allowing scalable and secure API access.

Why does my refresh token rotation logic invalidate active user sessions?▼

Refresh token rotation invalidates active user sessions when a previously used refresh token is detected during validation, indicating potential token reuse or theft. Revoking the token family immediately secures the account against session hijacking.