# @byu-oit-sdk/express-jwt

> Express plugin for verifying JWTs in express server requests

Latest version **0.4.0** (published 2026-04-29) · Apache-2.0 license · 0 weekly downloads

## Install

```sh
npm install @byu-oit-sdk/express-jwt
pnpm add @byu-oit-sdk/express-jwt
yarn add @byu-oit-sdk/express-jwt
bun add @byu-oit-sdk/express-jwt
```

## Health

**Score 60/100 (C)** — status: active.

Positive: has types; esm support; no vulnerabilities; high quality score.

Warnings: low downloads; pre 1.0.

## Facts

| | |
|---|---|
| Version | 0.4.0 |
| Published | 2026-04-29 |
| First published | 2023-08-23 |
| Weekly downloads | 0 |
| License | Apache-2.0 |
| TypeScript types | bundled |
| Module format | ESM + CommonJS |
| Node | >=22 |
| Dependencies | 3 |
| Unpacked size | 29.1 KB |
| Known vulnerabilities | 0 |
| Install scripts | no |
| Author | Spencer Tuft |
| Maintainers | stuft2, byu-oit-bot |

## Links

- npm: https://www.npmjs.com/package/@byu-oit-sdk/express-jwt
- Repository: https://github.com/byu-oit-sdk/javascript
- Homepage: https://github.com/byu-oit-sdk/javascript#readme
- Issues: https://github.com/byu-oit-sdk/javascript/issues
- npm.io page: https://npm.io/package/@byu-oit-sdk/express-jwt

## Dependencies (3)

- [tslib](https://npm.io/package/tslib.md) ^2.5.0
- [@byu-oit-sdk/jwt](https://npm.io/package/@byu-oit-sdk/jwt.md) ^0.4.0
- [@sinclair/typebox](https://npm.io/package/@sinclair/typebox.md) ^0.34.41

## Recent versions

- 0.4.0 (latest) — 2026-04-29
- 0.3.1 — 2026-04-07
- 0.3.0 — 2026-04-06
- 0.2.0 — 2025-07-22
- 0.1.22 — 2025-05-01
- 0.1.21 — 2025-04-01
- 0.1.20 — 2025-03-18
- 0.1.19 — 2025-03-12
- 0.1.18 — 2025-02-20
- 0.1.17 — 2025-02-19
- 0.1.16 — 2025-01-22
- 0.1.15 — 2025-01-21
- 0.1.14 — 2024-11-14
- 0.1.13 — 2024-10-29
- 0.1.12 — 2024-10-11
- … 28 more at https://npm.io/package/@byu-oit-sdk/express-jwt/versions

## README

# @byu-oit-sdk/jwt-express

**Requirements**:

- Node.js 18+
- npm v9+

## Installing


```shell
npm install @byu-oit-sdk/jwt-express
```

## Introduction

This express plugin allows for verification and decoding of JWTs. 

## Options

> Along with the options for the CreateJwt() function (see docs for jwt package), the following options can be passed in when registering the plugin with fastify.

| Option            | Type                                        | Default | Description                                                                                                        |
|-------------------|---------------------------------------------|---------|--------------------------------------------------------------------------------------------------------------------|
| prefix            | string                                      | -       | Used to specify what route the middleware is registered with.                                                      |
| transformer       | JwtPayloadTransformer<Payload, Transformer> | -       | The function that you will use for manipulating the JWT you are authenticating.                                    |
| getJwt            | function                                    | -       | A function for getting the JWT from the request. By default, the JWT is pulled from the auth header.               |
| validate          | boolean                                     | -       | Boolean used to signify if we want to validate the jwt if true, or just decode it if false.                        |

## Usage

<details>
<summary>TypeScript Coding Example</summary>


```typescript
import express from 'express'
import request from 'supertest'
import { verifyJwtPlugin } from '../src/express.js'
import { Type } from '@sinclair/typebox'

// set up express server
const app = express()

// use the transformer
const transformer = (payload: { 'http://byu.edu/claims/client_preferred_first_name': string }): { preferred_first_name: string } => ({ preferred_first_name: payload['http://byu.edu/claims/client_preferred_first_name'] })
try {
  app.use(verifyJwtPlugin({ schema: Type.Object({ }, { additionalProperties: true }), key: '', validate: false, transformer }))
} catch (e) {
  console.log(e)
}

// define an endpoint
app.get('/', (req, res) => {
  res.send(req.caller)
})
const server = app.listen(3000)

const response = await request(server).get('/').set('Authorization', /* A valid token */).send({ })
console.log(response)

server.close()


```

</details>

---
_Source: https://npm.io/package/@byu-oit-sdk/express-jwt · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._