@nestjs/jwt

@nestjs/jwt is the official Nest module wrapping the jsonwebtoken library, exposing a JwtService that any Nest provider can inject to sign, verify, and decode JSON Web Tokens. JwtModule.register()/registerAsync() configure secrets, signing algorithms, and key providers once at the module level, so individual providers don’t need to manage token logic themselves.

It supports both static secrets and dynamic key resolution via a secretOrKeyProvider function (with sync and async variants), plus asymmetric public/private key pairs for algorithms like RS256 — making it a drop-in building block for a Nest application’s authentication layer, typically paired with @nestjs/passport and a JWT strategy.

What You Get

• A JwtModule.register()/registerAsync() API for configuring JWT secrets, algorithms, and expiry once at the module level
• An injectable JwtService with sign(), verify(), and decode() methods available anywhere in the Nest dependency graph
• Support for both static secrets and dynamic key resolution via secretOrKeyProvider (sync and async)
• Support for asymmetric public/private key pairs for algorithms like RS256
• Direct pass-through of jsonwebtoken’s sign/verify options, so existing jsonwebtoken configuration transfers directly

Common Use Cases

• Issuing access tokens after a successful login in a Nest authentication service
• Verifying bearer tokens inside a custom Nest guard or Passport JWT strategy
• Rotating or dynamically resolving signing keys per-tenant via secretOrKeyProvider
• Signing short-lived tokens for password-reset or email-verification links
• Building a microservice-to-microservice auth handshake using shared or asymmetric JWT signing

Under The Hood

Architecture - The module follows Nest’s standard dynamic-module pattern: lib/jwt.module.ts implements register()/registerAsync() to wire up JwtService as a provider using the options supplied, lib/jwt.providers.ts resolves those options (including async factory/dependency-injected configuration), and lib/jwt.service.ts is a thin @Injectable() wrapper around the underlying jsonwebtoken package’s sign/verify/decode functions, adding support for the secretOrKeyProvider indirection layer.

Tech Stack - TypeScript, built against the @nestjs/common peer dependency (supporting Nest 8 through 11), depending on jsonwebtoken for the actual cryptographic signing/verification. Tests run under Vitest (migrated from Jest), linting via oxlint, and releases are cut with release-it and conventional commits enforced by commitlint.

Code Quality - lib/jwt.service.spec.ts is the primary test file, covering the service’s sign/verify/decode behavior including the async secretOrKeyProvider path; being a thin, focused wrapper around a well-tested underlying library (jsonwebtoken) keeps its own surface area — and therefore its bug surface — intentionally small. The codebase totals under 1,000 lines across lib/, consistent with its scope as a framework-integration module rather than a standalone cryptography implementation.

API Design - The two-touchpoint design (configure JwtModule once, inject JwtService everywhere) matches Nest’s idiomatic dependency-injection style, so using it requires no more boilerplate than any other Nest provider. Passing jsonwebtoken’s native options straight through to sign()/verify() means developers already familiar with that library carry their knowledge over directly rather than learning a new options schema.