OAuth & JWT Authentication Cheat Sheet

# 1. Generate PKCE verifier and challengeCODE_VERIFIER=$(openssl rand -base64 32 | tr -d '=+/')CODE_CHALLENGE=$(echo -n "$CODE_VERIFIER" | openssl dgst -sha256 -binary | base64 | tr -d '=+/')# 2. Redirect the user to the authorization endpoint# https://auth.example.com/authorize?#   response_type=code&client_id=abc123&redirect_uri=https://app.com/callback#   &scope=openid%20profile&state=xyz&code_challenge=$CODE_CHALLENGE&code_challenge_method=S256# 3. Exchange the returned ?code=... for tokenscurl -X POST https://auth.example.com/token \  -d grant_type=authorization_code \  -d code=AUTH_CODE_FROM_REDIRECT \  -d redirect_uri=https://app.com/callback \  -d client_id=abc123 \  -d code_verifier=$CODE_VERIFIER# Response# {"access_token":"eyJ...","refresh_token":"...","expires_in":3600,"token_type":"Bearer"}

// A JWT has 3 base64url parts: header.payload.signature// eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjMifQ.SflKxwRJSMeKKF2QT4f...const jwt = require('jsonwebtoken');// Sign (server issues token)const token = jwt.sign(  { sub: 'user123', role: 'admin' },  process.env.JWT_SECRET,  { expiresIn: '1h', issuer: 'api.example.com' });// Verify (server validates incoming token)try {  const payload = jwt.verify(token, process.env.JWT_SECRET, {    issuer: 'api.example.com',  });  console.log(payload.sub);} catch (err) {  // TokenExpiredError, JsonWebTokenError, etc.  console.error('Invalid token:', err.message);}

const { createRemoteJWKSet, jwtVerify } = require('jose');// Cached, auto-refreshing set of the issuer's public signing keysconst JWKS = createRemoteJWKSet(  new URL('https://auth.example.com/.well-known/jwks.json'));async function verifyAccessToken(token) {  const { payload, protectedHeader } = await jwtVerify(token, JWKS, {    issuer: 'https://auth.example.com',    audience: 'api://my-api',  });  // protectedHeader.kid tells you which key in the JWKS signed this token,  // so the issuer can rotate keys without invalidating already-issued tokens  return payload;}// JWKS document shape:// { "keys": [ { "kty": "RSA", "kid": "2026-01", "n": "...", "e": "AQAB", "alg": "RS256", "use": "sig" } ] }

async function refresh(oldRefreshToken) {  const record = await db.refreshTokens.findByToken(oldRefreshToken);  if (!record) throw new Error('unknown refresh token');  if (record.revoked) {    // The token was already used once before -> this is a replay.    // Assume the whole token family is compromised and kill every    // descendant issued from the same original login.    await db.refreshTokens.revokeFamily(record.familyId);    throw new Error('refresh token reuse detected — session family revoked');  }  // Rotate: invalidate the old token, mint a new one in the same family  await db.refreshTokens.revoke(record.id);  const newRefreshToken = generateOpaqueToken();  await db.refreshTokens.create({    token: newRefreshToken,    familyId: record.familyId,    userId: record.userId,  });  const accessToken = signAccessToken({ sub: record.userId });  return { accessToken, refreshToken: newRefreshToken };}

# Introspection: ask the auth server whether a token is still valid# (needed for opaque tokens, or JWTs you want to check against a revocation list)curl -X POST https://auth.example.com/introspect \  -u client_id:client_secret \  -d token=eyJhbGciOiJSUzI1NiJ9...# Response# {"active": true, "scope": "read write", "sub": "user123", "exp": 1739980800}# Revocation: invalidate a token immediately (e.g. on logout)curl -X POST https://auth.example.com/revoke \  -u client_id:client_secret \  -d token=eyJhbGciOiJSUzI1NiJ9... \  -d token_type_hint=refresh_token# Because JWT access tokens are self-contained, revoking them before exp# requires either a short TTL + refresh, or checking a deny-list keyed on 'jti'