ProvenPin Install

Fastify 5 + @fastify/jwt protected routes: working versions (tested 2026-10-15)

Sign and verify JWTs in Fastify 5 with @fastify/jwt and an authenticate preHandler that guards routes.

passed3 passed · 0 failed2026-10-15 12:53 UTC
Status
passed
Last passed
2026-10-15 12:53 UTC
Tests
3 / 3
Language
TypeScript
Runtime
node v22.23.3
pinned versions4
fastify@5.12.7@fastify/jwt@10.2.4tsx@4.23.15@types/node@24.19.2
run it
npm install --no-audit --no-fund --ignore-scripts=false
npm test
test environment
node v22.23.3
linux 6.17.0-1022-azure
x64
runner: github-actions 38737894352

The code

Exactly the files that passed. Your agent can pull them with get_recipe("fastify-jwt-auth") (install), or see them on GitHub.

package.json
{
  "name": "fastify-jwt-auth",
  "private": true,
  "type": "module",
  "scripts": {
    "test": "node --import tsx --test test/*.test.ts"
  },
  "dependencies": {
    "fastify": "5.12.7",
    "@fastify/jwt": "10.2.4"
  },
  "devDependencies": {
    "tsx": "4.23.15",
    "@types/node": "24.19.2"
  }
}
src/app.ts
import Fastify, { type FastifyReply, type FastifyRequest } from "fastify";
import fastifyJwt from "@fastify/jwt";

export function buildApp(secret: string) {
  const app = Fastify();
  app.register(fastifyJwt, { secret });

  const authenticate = async (req: FastifyRequest, reply: FastifyReply) => {
    try { await req.jwtVerify(); } catch { return reply.code(401).send({ error: "unauthorized" }); }
  };

  app.post<{ Body: { username: string; password: string } }>("/login", {
    schema: { body: { type: "object", required: ["username", "password"], properties: { username: { type: "string" }, password: { type: "string" } } } },
  }, async (req, reply) => {
    if (req.body.password !== "secret") return reply.code(401).send({ error: "invalid_credentials" });
    return { token: app.jwt.sign({ sub: req.body.username }, { expiresIn: "1h" }) };
  });

  app.get("/me", { preHandler: authenticate }, async (req) => ({ user: (req.user as { sub: string }).sub }));
  return app;
}
test/app.test.ts
import { test } from "node:test";
import assert from "node:assert/strict";
import { buildApp } from "../src/app.ts";

test("login then access /me", async () => {
  const app = buildApp("test-secret");
  const login = await app.inject({ method: "POST", url: "/login", payload: { username: "ada", password: "secret" } });
  assert.equal(login.statusCode, 200);
  const me = await app.inject({ method: "GET", url: "/me", headers: { authorization: `Bearer ${login.json().token}` } });
  assert.deepEqual(me.json(), { user: "ada" });
  await app.close();
});

test("rejects missing or bad tokens", async () => {
  const app = buildApp("test-secret");
  assert.equal((await app.inject({ method: "GET", url: "/me" })).statusCode, 401);
  assert.equal((await app.inject({ method: "GET", url: "/me", headers: { authorization: "Bearer nope" } })).statusCode, 401);
  await app.close();
});

test("schema rejects incomplete login body", async () => {
  const app = buildApp("test-secret");
  assert.equal((await app.inject({ method: "POST", url: "/login", payload: { username: "ada" } })).statusCode, 400);
  await app.close();
});

Connect to ProvenPin

Add the free MCP server so your agent can pull this recipe and others like it. Same setup as the docs.

terminal
claude mcp add --transport http provenpin https://mcp.provenpin.com/mcp

Any other MCP client: Streamable HTTP at https://mcp.provenpin.com/mcp. No API key, no signup.

Related stacks

Fastify 5 + Zod 4 type provider for typed routes

Use fastify-type-provider-zod so Zod 4 schemas validate requests, serialize responses and type handlers in Fastify 5.

Fastify · Zod · fastify-type-provider-zod

Fastify 5 routes with JSON Schema validation

Fastify 5 route validation and response serialization with JSON Schema, tested via app.inject().

Fastify

All Fastify recipesAll @fastify/jwt recipes