Express

Install

pnpm add @clowk/express @clowk/core

Configure

app.ts

import express from 'express'
import { clowkMiddleware, requireAuth } from '@clowk/express'

const app = express()

Protect all routes

Apply the middleware globally. The decoded JWT is available on req.auth:

app.use(clowkMiddleware({
  secretKey: process.env.CLOWK_SECRET_KEY,
}))

app.get('/dashboard', (req, res) => {
  res.json({ user: req.auth })
})

Protect specific routes

Use requireAuth() to gate individual routes — returns 401 if no valid token:

app.get('/public', (req, res) => {
  res.json({ message: 'This is public' })
})

app.get('/protected', requireAuth(), (req, res) => {
  res.json({ user: req.auth })
})

How it works

The middleware extracts and verifies the JWT from (in order):

Query parameter — ?token=eyJ...
Authorization header — Bearer eyJ...
Cookie — clowk_token

With clowkMiddleware, req.auth is null if no token is found (soft auth). With requireAuth, the request is rejected with 401 before reaching your handler.

Next steps

Hono quickstart — for Workers, Bun, Deno
Full Express integration — complete API reference