Developers · Users and Permissions

Authenticating a User with a JWT Token

Last updated 1 November 2026

This guide discusses how to authenticate JSON requests with a JWT token.

Prerequisites

To follow the steps in this tutorial, you must understand the concept of pages, users, and Permissions.

Steps

Authenticating a user with a JWT token is a three-step process:

Step 1: Fetch the JWT token for a user
Step 2: Create a page with a policy that checks the JWT token
Step 3: Send signed request

Step 1: Fetch JWT Token for a User

You can do this after the user login; The system should usually store the token in the browser memory.

app/graphql/user_jwt_token.graphql

{
  current_user{
    jwt_token
  }
}

Note

Tokens from expire. By default, they expire after the session timeout, and a password change revokes them.

Step 2: Create a Page with a Policy that Checks the JWT Token

The Authorization Policy fetches the JWT token from the request header and sets the current user using this token.

app/graphql/jwt_login.graphql

mutation jwt_login($token: String!) {
  jwt_decode_and_set_session(jwt_token: $token) {
    email
    first_name
    last_name
    jwt_token
    id
  }
}

app/authorization_policies/api_set_current_user.liquid

An Authorization Policy must print true or false on every path. This one prints false when the request has no Authorization header.

---
name: api_set_current_user
---
{% if context.headers.HTTP_AUTHORIZATION %}
  {%- assign token = context.headers.HTTP_AUTHORIZATION | remove: 'Bearer ' -%}
  {%- graphql g = 'jwt_login', token: token -%}
  {% if g.jwt_decode_and_set_session %}
    {%- assign current_user = g.jwt_decode_and_set_session %}
    true
  {% else %}
    {% log g %}
    false
  {% endif %}
{% else %}
  false
{% endif %}

app/views/pages/api/orders.json.liquid

---
slug: api/orders
layout: ''
authorization_policies:
- api_set_current_user
---
{% comment %} Load the orders of the signed-in user here {% endcomment %}
{% assign orders = [] %}
{{ orders | json }}

Step 3: Send the Signed Request

curl

curl -i -H 'Content-Type: application/json' 
  -H 'Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjoxNTg2MTB9.i23YVYeckeoNeYmO3UKpvWfAWek96YUx8S7k5VKrIcM' 
  -XPOST https://example.staging-insites.io/api/orders.json

js fetch

fetch('https://example.staging-insites.io/api/orders.json', {
  headers: {
    Authorization: 'Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjoxNTg2MTB9.i23YVYeckeoNeYmO3UKpvWfAWek96YUx8S7k5VKrIcM',
    'Content-Type': 'application/json'
  },
  method: 'POST'
})