A Fastify plugin to require bearer Authorization headers
Clone or download
Latest commit 84a0f29 Oct 3, 2018
Type Name Latest commit message Commit time
Failed to load latest commit information.
test Update deps, fix linting Oct 3, 2018
.gitignore implement constant time key check (#8) May 1, 2018
.travis.yml Remove Node 9 and Node 10 (#9) May 5, 2018
Readme.md Update Readme.md (#12) Jun 28, 2018
package.json Update deps, fix linting Oct 3, 2018
plugin.js Update deps, fix linting Oct 3, 2018



Greenkeeper badge

fastify-bearer-auth provides a simple request hook for the Fastify web framework.


'use strict'

const fastify = require('fastify')()
const bearerAuthPlugin = require('fastify-bearer-auth')
const keys = new Set(['a-super-secret-key', 'another-super-secret-key'])

fastify.register(bearerAuthPlugin, {keys})
fastify.get('/foo', (req, reply) => {
  reply({authenticated: true})

fastify.listen({port: 8000}, (err) => {
  if (err) {


fastify-bearer-auth exports a standard Fastify plugin. This allows you to register the plugin within scoped paths. Therefore, you could have some paths that are not protected by the plugin and others that are. See the Fastify documentation and examples for more details.

When registering the plugin you must specify a configuration object:

  • keys: A Set or array with valid keys of type string (required)
  • function errorResponse (err) {}: method must synchronously return the content body to be sent to the client (optional)
  • contentType: If the content to be sent is anything other than application/json, then the contentType property must be set (optional)

The default configuration object is:

  keys: new Set(),
  contentType: undefined,
  errorResponse: (err) => {
    return {error: err.message}

Internally, the plugin registers a standard Fastify preHandler hook which will inspect the request's headers for an authorization header with the format bearer key. The key will be matched against the configured keys object via a constant time alogrithm to prevent against timing-attacks. If the authorization header is missing, malformed, or the key does not validate then a 401 response will be sent with a {error: message} body; no further request processing will be performed.


MIT License