# @loopback/authorization

> A LoopBack component for authorization support.

Latest version **0.16.16** (published 2026-08-18) · MIT license · 0 weekly downloads

## Install

```sh
npm install @loopback/authorization
pnpm add @loopback/authorization
yarn add @loopback/authorization
bun add @loopback/authorization
```

## Health

**Score 65/100 (B)** — status: active.

Positive: has types; no vulnerabilities; recently updated; high maintenance score; high quality score.

Warnings: low downloads; no esm support; pre 1.0.

## Facts

| | |
|---|---|
| Version | 0.16.16 |
| Published | 2026-08-18 |
| First published | 2019-08-15 |
| Weekly downloads | 0 |
| License | MIT |
| TypeScript types | bundled |
| Module format | CommonJS |
| Node | 20 \|\| 22 \|\| 24 |
| Dependencies | 3 |
| Unpacked size | 61.3 KB |
| Known vulnerabilities | 0 |
| Install scripts | no |
| GitHub stars | 5107 |
| Author | IBM Corp. and LoopBack contributors |
| Maintainers | rfeng, rmg, dhmlau, theprez, frbuceta, marioestradarosa, achrinza |
| Keywords | LoopBack, Authorization |

## Links

- npm: https://www.npmjs.com/package/@loopback/authorization
- Repository: https://github.com/loopbackio/loopback-next
- Homepage: https://github.com/loopbackio/loopback-next#readme
- Issues: https://github.com/loopbackio/loopback-next/issues
- npm.io page: https://npm.io/package/@loopback/authorization

## Dependencies (3)

- [debug](https://npm.io/package/debug.md) ^4.4.3
- [tslib](https://npm.io/package/tslib.md) ^2.8.1
- [@loopback/security](https://npm.io/package/@loopback/security.md) ^0.12.16

## Alternatives

- [@clerk/clerk-expo](https://npm.io/package/@clerk/clerk-expo.md) — 133.6K weekly downloads
- [@pothos/plugin-authz](https://npm.io/package/@pothos/plugin-authz.md) — 12.4K weekly downloads
- [@bounded-sh/client](https://npm.io/package/@bounded-sh/client.md) — 3.2K weekly downloads
- [@luigi-project/plugin-auth-oauth2](https://npm.io/package/@luigi-project/plugin-auth-oauth2.md) — 2.3K weekly downloads
- [@nocobase/plugin-verification](https://npm.io/package/@nocobase/plugin-verification.md) — 2.0K weekly downloads

## Recent versions

- 0.16.16 (latest) — 2026-08-18
- 0.16.15 — 2026-07-16
- 0.16.14 — 2026-06-11
- 0.16.13 — 2026-05-12
- 0.16.12 — 2026-04-14
- 0.16.11 — 2026-03-11
- 0.16.10 — 2026-02-10
- 0.16.9 — 2026-01-12
- 0.16.8 — 2025-12-09
- 0.16.7 — 2025-11-11
- 0.16.6 — 2025-10-15
- 0.16.5 — 2025-09-10
- 0.16.4 — 2025-08-11
- 0.16.3 — 2025-07-15
- 0.16.2 — 2025-06-13
- … 90 more at https://npm.io/package/@loopback/authorization/versions

## README

# @loopback/authorization

A LoopBack 4 component for authorization support (Role based, Permission based,
Vote based)

To read on key building blocks read through
[loopback authorization docs](https://loopback.io/doc/en/lb4/Loopback-component-authorization.html)

![Authorization](imgs/authorization.png)

## Installation

```shell
npm install --save @loopback/authorization
```

## Basic use

The following example shows the basic use of `@authorize` decorator, authorizer
and authorization component by authorizing a client according to its role:

ASSUMING your app uses jwt as the authentication strategy, and the user
information is encoded in the token from a request's header.

### Define Role Property

First **define `role` as a property in your User model** so that after a user
logs in, the client's requests will contain that user's role.

```ts
@model()
export class User extends Entity {
  @property({
    type: 'string',
    id: true,
  })
  id: string;

  @property({
    type: 'string',
    id: true,
  })
  role: string;
```

### Decorate Controller Method

Then **decorating your controller methods with `@authorize`** to require the
request to be authorized.

```ts
import {authorize} from '@loopback/authorization';
import {get} from '@loopback/rest';

export class MyController {
  // user with ADMIN role can see the number of views
  @authorize({allowedRoles: ['ADMIN']})
  @get('/number-of-views')
  numOfViews(): number {
    return 100;
  }
}
```

### Create Authorizer Provider

Next **create an authorizer provider** that compares the request sender's role
and the visited endpoint's allowed roles, and returns decision ALLOW if they
match.

```ts
export class MyAuthorizationProvider implements Provider<Authorizer> {
  constructor() {}

  /**
   * @returns authenticateFn
   */
  value(): Authorizer {
    return this.authorize.bind(this);
  }

  async authorize(
    authorizationCtx: AuthorizationContext,
    metadata: AuthorizationMetadata,
  ) {
    const clientRole = authorizationCtx.principals[0].role;
    const allowedRoles = metadata.allowedRoles;
    return allowedRoles.includes(clientRole)
      ? AuthorizationDecision.ALLOW
      : AuthorizationDecision.DENY;
  }
}
```

Finally, **bind the authorizer and mount the authorization component** to your
application. The authorization component can be configured with options:

```ts
const options: AuthorizationOptions = {
  precedence: AuthorizationDecisions.DENY,
  defaultDecision: AuthorizationDecisions.DENY,
};

const binding = app.component(AuthorizationComponent);
app.configure(binding.key).to(options);

app
  .bind('authorizationProviders.my-authorizer-provider')
  .toProvider(MyAuthorizationProvider)
  .tag(AuthorizationTags.AUTHORIZER);
```

After setting up the authorization system, you can create a user with role
`ADMIN`, login and get the token, then visit endpoint `GET /number-of-views`
with the generated token in the request header.

### Summary and Diagram

Here is a summary of the use case and diagram for the example:

Endpoint: GET /number-of-views

Controller method:

```ts
@authenticate(‘jwt’)
@authorize({allowedRoles: ['ADMIN']})
@get('/number-of-views')
numOfViews(): number {
  return 100;
}
```

Use case:

![Use case](imgs/use-case.png)

Authorization artifacts' responsibilities:

![Authorization artifacts' responsibilities](imgs/responsibilities.png)

## Extract common layer

`@loopback/authentication` and `@loopback/authorization` share the client
information from the request. Therefore we have created another module,
`@loopback/security` with types/interfaces that describe the client, like
`principles`, `userProfile`, etc.

## Related resources

## Contributions

- [Guidelines](https://github.com/loopbackio/loopback-next/blob/master/docs/CONTRIBUTING.md)
- [Join the team](https://github.com/loopbackio/loopback-next/issues/110)

## Tests

run `npm test` from the root folder.

## Contributors

See
[all contributors](https://github.com/loopbackio/loopback-next/graphs/contributors).

## License

MIT

---
_Source: https://npm.io/package/@loopback/authorization · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._