Payload offers the ability to Authenticate via JSON Web Tokens (JWT). These can be read from the responses of login, logout, refresh, and me auth operations.

Identifying Users Via The Authorization Header

In addition to authenticating via an HTTP-only cookie, you can also identify users via the Authorization header on an HTTP request.

Example:

1const user = await fetch('http://localhost:3000/api/users/login', {
2  method: 'POST',
3  body: JSON.stringify({
4    email: 'dev@payloadcms.com',
5    password: 'password',
6  })
7}).then(req => await req.json())
8
9const request = await fetch('http://localhost:3000', {
10  headers: {
11    Authorization: `JWT ${user.token}`,
12  },
13})

Omitting The Token

In some cases you may want to prevent the token from being returned from the auth operations. You can do that by setting removeTokenFromResponse to true like so:

1import type { CollectionConfig } from 'payload'
2
3export const UsersWithoutJWTs: CollectionConfig = {
4  slug: 'users-without-jwts',
5  auth: {
6    removeTokenFromRepsonse: true, 
7  },
8}

Deploy your entire stack in one place with Payload Cloud.

Microsoft chose Payload to tell the world about AI.

JWT Strategy

Identifying Users Via The Authorization Header

Omitting The Token

API Key Strategy

On this page