Skip to main content

Authentication & Authorization

Two separate questions come up on almost every request a real API handles: who is this, and are they allowed to do this specific thing. RapidREST keeps those two questions genuinely separate.

Authentication is proving who's calling, @rapidrest/service-core does this with JSON Web Tokens out of the box, the same token verification you'd reach for in front of any interoperable backend service.

Authorization is deciding what an already-identified caller can do, and RapidREST gives you two levels of it: a quick role check per endpoint, and a full Roles Based Access Control (RBAC) system with per-record Access Control Lists when a role check alone isn't precise enough.

Neither system requires the other to be elaborate. A token can prove identity without your API caring about roles at all, and role checks can gate an endpoint without a single ACL record existing anywhere in your database. Reach for the next level of precision only when a coarser one stops being enough.

  • Authentication — JWTStrategy, @Auth, and what a caller actually has to send.
  • Authorization — @RequiresRole and @RequiresScope, the fast, per-endpoint checks.
  • Access Control Lists — @Protect, per-record permissions, and everything ACL inheritance actually does.
Need a real login flow, not just token verification?

Everything on this page verifies a token that was already issued, it has no opinion on how that token gets issued in the first place. For password/TOTP/WebAuthn/OIDC login flows, real user accounts, and the rest of what "signing in" usually means, see the Auth Library plugin, or Auth Server for a complete, ready-to-deploy reference implementation built from it.