Guest access

Guest tokens are signed, short-lived, and purpose-bound. Signing is asynchronous in core 2.x.

const token = await auth.guestToken();

The included middleware issues a guest token and verifies that it belongs to the guest token class:

app.get('/guest', auth.incognito, (req, res) => {
  res.json({message: 'Guest access'});
});

Guest access is not a substitute for an authenticated human or agent identity. Do not grant it user-owned, administrator, or machine scopes.