rewt

library3.0.0jsnpmunverified

rewt is a Node.js library that wraps JWT (JSON Web Token) signing and verification, sourcing a shared secret from Redis for easy and fast rotation. Version 3.0.0 is the latest stable release. The library automatically handles secret generation with TTL for rotation, allows manual secret invalidation, and supports custom namespacing. It is designed for server-to-server authentication scenarios where secret rotation and revocation are critical.

security

npm install rewt

github ↗package ↗homepage ↗

INSTALL

IMPORT

SIG · REWT

rewt

securityjavascriptv3.0.0

harness data pending

Install & Compatibility

Where this runs

No compatibility data collected yet for this library.

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

Rewt

✓ import Rewt from 'rewt';

✗ const { Rewt } = require('rewt');

Default export in v3. CommonJS users: const Rewt = require('rewt').

Rewt

✓ const Rewt = require('rewt');

✗ const rewt = require('rewt'); (if expecting instance)

Rewt is a class, not an instance. Must instantiate with new.

Rewt

✓ import type Rewt from 'rewt'; (TypeScript)

TypeScript types are included? Check DefinitelyTyped if missing.

Shows init with Redis connection, signing a JWT, verifying it, and cleanup. Uses async/await with callback-based API.

import Rewt from 'rewt'; import { createClient } from 'redis'; const redis = createClient({ url: process.env.REDIS_URL ?? 'redis://localhost:6379' }); await redis.connect(); const rewt = new Rewt({ redisConn: redis, ttl: 60 * 60, // 1 hour }); const token = await new Promise((resolve, reject) => { rewt.sign({ sub: 'user123', role: 'admin' }, (err, signed) => { if (err) reject(err); else resolve(signed); }); }); // Token signed with automatic secret rotation const payload = await new Promise((resolve, reject) => { rewt.verify(token, (err, decoded) => { if (err) reject(err); else resolve(decoded); }); }); console.log('Verified:', payload); await redis.quit();

Debug

Known issues

breakingrewt v3 drops support for Node.js < 10 and requires Redis 5+.

fix

Upgrade Node to >=10 and Redis to >=5.

affects: >=3.0.0

deprecatedThe original Redis client `redis` is deprecated in favor of `redis` v4 with async `createClient`.

fix

Use `redis` v4 and call `.connect()` before passing to Rewt.

affects: >=2.0.0

gotchaTTL is in seconds, not milliseconds. Common mistake causes instant expiration.

fix

Set ttl in seconds (e.g., 86400 for 24h).

affects: >=1.0.0

gotchaCallbacks are required. No promise or async/await support built-in; must promisify manually.

fix

Wrap `sign` and `verify` in Promise constructor.

affects: >=1.0.0

gotchaSecret key in Redis is stored under `{namespace}:secret`. If multiple apps share Redis, ensure namespace uniqueness.

fix

Set unique `redisNamespace` per application.

affects: >=1.0.0

Errors

Common errors & fixes

Error: Secret is not defined

Redis client not connected or no secret in Redis after flush.

fix

Ensure Redis connection is established and rewt has been used to sign at least one token to generate the secret.

TypeError: Rewt is not a constructor

Using default export as a class but not destructuring correctly in CommonJS.

fix

Use `const Rewt = require('rewt');` (not `const { Rewt } = require('rewt');`).

jwt malformed

Token string is empty, malformed, or not a JWT.

fix

Ensure the token passed to `verify` is a valid signed JWT string.

Upgrade

Version history

3.0.0latest on npm

Audit

Dependencies

redisrequiredRequired to connect to Redis and source the shared secret.

jsonwebtokenrequiredUsed for actual JWT signing and verification behind the scenes.

Agent activity

22 hits · last 30 days

node

Amazon

OpenAI (training)

Resources

githubhttps://github.com/mixmaxhq/rewt ↗

packagerewt ↗

homepagehttps://github.com/mixmaxhq/rewt#readme ↗