To authenticate a NestJS API, validate a user’s credentials, establish an identity for each request, and use guards to keep protected handlers from running for callers without acceptable credentials. For a choose-your-own-adventure API, that can mean public sign-in routes, authenticated profile or story routes, and separate authorization checks for who may edit a story or choice.
This guide uses the Passport-based approach in NestJS’s official recipe: a local strategy for sign-in and a JWT bearer strategy for protected requests. It is a framework pattern, not a reconstruction of an existing series repository. Confirm your NestJS version and dependencies before copying code; NestJS also documents a newer, distinct @nestjs/authentication path. NestJS Passport recipe · NestJS authentication guide
As an Amazon Associate I earn from qualifying purchases.
What authentication changes in the request flow
Authentication answers “who is making this request?” Authorization answers “what is this user allowed to do?” A signed-in reader might be allowed to view a story but not edit its ending; a creator may have permission to update only stories they own. Treat identity and those resource-level rules as separate decisions.
In a Passport flow, the local strategy validates credentials at sign-in. After successful validation, the login handler can issue a JWT. On a later request, the JWT strategy extracts a bearer token from the Authorization header, verifies it, and makes its user data available to the handler. A guard decides whether that handler can run. NestJS Passport recipe
#1 Best Overall
Choose one NestJS authentication path
NestJS currently documents two approaches that should not be treated as interchangeable APIs:
- Passport: The official recipe uses
@nestjs/passportwith Passport strategies, commonly alongsidepassport-local,@nestjs/jwt, andpassport-jwt. It fits projects already using that package family or a series whose existing code follows the recipe. NestJS Passport recipe @nestjs/authentication: The current security guide documents an authentication module with sessions and bearer-token providers, application-owned user loading, and policy for public routes. Consider it when starting fresh, but check its APIs and compatibility against your actual NestJS version and dependencies. NestJS authentication guide
The title alone does not identify a repository, package lockfile, or NestJS version, so it cannot establish which path the earlier parts of a particular series use. Continue the existing project’s tested package family rather than mixing examples from both guides.
Choose sessions or bearer tokens for the client
NestJS documents both server-side sessions, commonly carried by cookies, and bearer JWTs carried in request headers. The right choice depends on the client and the way the application needs to manage sign-in state.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →| Decision point | Server-side session | Bearer JWT |
|---|---|---|
| Where authenticated state lives | In a server-side session store; the browser carries a session cookie. | In token claims; the client sends the token as a bearer credential. |
| Client request credential | Cookie, with cookie and cross-site request protections considered for browser clients. | Authorization: Bearer <token>. |
| Sign-out and revocation | Invalidate the server-side session. | Plan for token expiry and, if immediate invalidation is needed, a revocation or refresh-token policy; a signed access token can otherwise remain usable until it expires. |
| Operational needs | Operate and protect the session store, including its availability across application instances. | Protect signing keys and define verification, lifetime, and refresh behavior. |
The NestJS guide describes a mobile-client pattern using a short-lived access token and a longer-lived refresh token. That is an option, not a requirement for every API. NestJS authentication guide
Implement the Passport request flow
The following is the shape of the flow, not a complete drop-in module: the series’ database, user entity, package versions, and existing module structure are unspecified. Adapt names and registration to the chosen project version and the official recipe.
- Validate credentials in the local strategy. Pass the submitted username and password to an application service. Look up the account and verify its stored password hash. Return a user identity only on success; do not return the stored hash.
- Guard the login route with the local strategy. A successful guard makes the validated user available to the route handler. Have the handler call the authentication service to create a token or session, according to the selected design.
- Configure bearer-token validation. For a JWT design, configure the JWT strategy to extract a bearer token from the authorization header and verify it with the expected key and claims.
- Guard protected routes with the JWT strategy. The strategy validates each request’s token and supplies the authenticated identity to the handler. Use a shared guard consistently on routes that require sign-in.
- Apply authorization rules to resources. Before an edit or delete operation, check whether the authenticated user owns the target story or has the required role or permission. Authentication alone does not grant that access.
The Passport recipe demonstrates the local-strategy, JWT-strategy, and route-guard pattern. NestJS Passport recipe
Rank #3
Use guards to control access
A NestJS guard is an injectable class implementing CanActivate. It can inspect the request and route context and allow or reject execution. NestJS runs guards after middleware and before interceptors or pipes, so middleware may parse or attach request data while a guard makes the route-access decision. NestJS guards guide
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
You can attach a selected guard to individual handlers or controllers. The current authentication guide also describes a global-guard design, where routes such as login or health checks must be deliberately made public. Avoid assuming a route is protected merely because another route uses authentication.
Set password and token safeguards
Hash passwords rather than storing or comparing plaintext
Store a purpose-built password hash, not a recoverable password. NestJS’s current hashing guide documents a PasswordHasher implementation based on scrypt, using a random salt and constant-time checking. Its documented parameters are N=217, r=8, and p=1, approximately 128 MiB of memory per hash; these are the parameters stated by that NestJS page, accessed October 7, 2026, not a performance promise for every deployment. NestJS encryption and hashing guide
The Passport recipe includes a deliberately simplified credential comparison example. Do not copy a plaintext password comparison into a production account system. Return a generic sign-in failure rather than revealing whether a username exists or a password was wrong.
Verify token policy, not just token presence
A JWT is acceptable only after signature verification and validation of the claims your application requires. Define the signing algorithm, expiry, expected issuer and audience where applicable, and what happens when access expires. The NestJS authentication guide describes validation of signature and, when configured, exp, iss, and aud. Its documented defaults for that package are a 15-minute access-token lifetime and a 30-day refresh-token lifetime; these are package defaults, not universal recommendations. NestJS authentication guide
Check duration units for the library you selected. The authentication guide uses milliseconds or duration strings, while numeric lifetimes in @nestjs/jwt use seconds. A readable value such as '15m' can help avoid unit mistakes when supported by the chosen API.
Protect signing secrets
Keep signing keys out of source control and do not deploy a tutorial placeholder as a real secret. NestJS recommends protecting production keys with measures such as a secrets vault, environment variable, or configuration service. NestJS Passport recipe
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Make public routes and failure behavior explicit
Write down the route policy before applying guards. In an adventure API, public story browsing may be useful, while account details and story edits may require authentication; the actual policy depends on the product. If a global guard is used, mark public routes deliberately. If guards are applied route by route, apply them consistently and test routes that should reject anonymous requests.
Quick Recap
- Missing, malformed, expired, or invalid credentials should not reach a protected handler.
- Credential failures should not disclose whether an account exists.
- Authenticated users should still be denied edits to resources they do not own or otherwise have permission to change.
- Login and any public health endpoint should remain accessible only by intentional policy, not accidental guard omissions.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitches
