Skip to main content

curl examples

These examples target the Express email and password presets at http://localhost:3000. The JWT-only preset uses POST /refresh instead of POST /auth/refresh.

Register​

curl -X POST http://localhost:3000/auth/register \
  -H "Content-Type: application/json" \
  -d '{"email":"dev@example.com","password":"use-a-long-test-password"}'

Log in​

curl -X POST http://localhost:3000/auth/login \
  -H "Content-Type: application/json" \
  -d '{"email":"dev@example.com","password":"use-a-long-test-password"}'

The response contains an ES256 access token and a stateful refresh token:

{
  "accessToken": "<access-token>",
  "refreshToken": "<refresh-token>"
}

Call a protected route​

curl http://localhost:3000/protected \
  -H "Authorization: Bearer <access-token>"

Rotate the refresh token​

curl -X POST http://localhost:3000/auth/refresh \
  -H "Content-Type: application/json" \
  -d '{"refreshToken":"<refresh-token>"}'

Replace the stored refresh token with the returned value. Reusing the old value is rejected.

Inspect public verification keys​

curl http://localhost:3000/.well-known/jwks.json

The endpoint returns public verification keys only. It must never expose the private d field.

Fullstack API​

The fullstack API is mounted below /api, uses a double-submit CSRF token for state-changing browser requests, and keeps refresh tokens in an HttpOnly cookie. Use the generated web client or first request GET /api/auth/csrf, retain its cookie, and send the returned value in x-csrf-token.

Do not adapt the simpler Express JSON refresh example by placing a fullstack refresh token in browser storage.