How JWT works

JWT (JSON Web Token) is how apps handle authentication. After logging in, the server gives you a token. You send that token with every future request to prove who you are. Think of it like a concert wristband: show your ID once at the door, get a wristband, then flash the wristband everywhere else. **The flow:** ``` 1. User logs in with email + password 2. Server verifies credentials 3. Server creates a JWT token 4. Client stores the token 5. Every request includes the token in the header 6. Server verifies the token on each request ```

// Creating a token (server side)
const jwt = require('jsonwebtoken')
const token = jwt.sign(
  { userId: 1, email: 'daniel@example.com' },
  process.env.JWT_SECRET,
  { expiresIn: '1h' }
)

// Verifying a token (server side)
jwt.verify(token, process.env.JWT_SECRET, (err, decoded) => {
  if (err) return res.status(401).json({ message: 'Invalid token' })
  console.log(decoded)  // { userId: 1, email: '...' }
})

// Sending token in requests (client side)
fetch('/api/profile', {
  headers: {
    'Authorization': `Bearer ${token}`
  }
})

How JWT works

Roadmap