{"id":1987,"date":"2021-07-19T12:00:00","date_gmt":"2021-07-19T10:00:00","guid":{"rendered":"https:\/\/kindsonthegenius.com\/blog\/nestjs-authentication-and-authorization-with-auth0-simplified-step-by-step\/"},"modified":"2026-07-05T03:26:03","modified_gmt":"2026-07-05T01:26:03","slug":"nestjs-authentication-and-authorization-with-auth0-simplified-step-by-step","status":"publish","type":"post","link":"https:\/\/kindsonthegenius.com\/blog\/nestjs-authentication-and-authorization-with-auth0-simplified-step-by-step\/","title":{"rendered":"NestJS Authentication and Authorization with Auth0 Simplified \u2013 Step by Step"},"content":{"rendered":"

In this step by step tutorial, you will learn how to secure your REST API endpoints using Auth0.<\/p>\n

    \n
  1. Create a NestJs Application<\/a><\/li>\n
  2. Add Two More API Endpoints<\/a><\/li>\n
  3. Create Authorization Module and Authorization Guard<\/a><\/li>\n
  4. Modify the Authorization Guard<\/a><\/li>\n
  5. Create New API for Auth0<\/a><\/li>\n
  6. Let’s Use a .env File<\/a><\/li>\n
  7. Add the ConfigService to the Authorization Guard<\/a><\/li>\n
  8. Finally Protect an API Endpoint<\/a><\/li>\n<\/ol>\n

     <\/p>\n

    1. Create a Nestjs Application<\/strong><\/h5>\n

    Step 1<\/strong> – Install the Nestjs command line interface.<\/p>\n

    npm install -g @nestjs\/cli\r\n<\/pre>\n
     <\/p>\n
    Step 2<\/strong> – Create an Nestjs Application\u00a0 using the command below
    \n<\/p>\n
    nest new nestjs-auth-demo\r\n<\/pre>\n
    Choose npm when prompted<\/p>\n
    Step 3<\/strong> – Once the application is created, you can open it using VS Code or any other editor.<\/p>\n
    Step 4<\/strong> – Launch it using the command:<\/p>\n
    npm run start -dev\r\n<\/pre>\n
     <\/p>\n
    Step 5<\/strong> – Go to http:\/\/localhost:3000 to make sure it works. You will see the message “Hello World”<\/p>\n
     <\/p>\n
    2. Add Two More Endpoints<\/strong><\/h5>\n
    We now need to add two endpoints: one that would be accessed without authentication and a second one that we would require authentication.<\/p>\n
    Step 1<\/strong> – Open the app.controller.ts file and add the following after the getHello() function<\/p>\n
    @<\/span>Get('\/public'<\/span>)\r\ngetPublic():<\/span> string<\/span> {\r\n  return<\/span> this<\/span>.appService.getPublic();\r\n}\r\n\r\n@<\/span>Get('\/protected'<\/span>)\r\ngetProtected():<\/span> string<\/span> {\r\n  return<\/span> this<\/span>.appService.getPrivate();\r\n}\r\n<\/pre>\n
     <\/p>\n
    Step 2<\/strong> – Open the app.service.ts file and add the following as well<\/p>\n
    getPrivate():<\/span> string<\/span> {\r\n  return<\/span> 'This is a public resource. Welcome visitor!'<\/span>;\r\n}\r\n\r\ngetPublic():<\/span> string<\/span> {\r\n  return<\/span> 'This is a protected resource. Welcome member'<\/span>;\r\n}\r\n<\/pre>\n
     <\/p>\n
    Step 3<\/strong> – Restart the server and test the all the endpoints. For now, we’ve not protected any of them<\/p>\n
     <\/p>\n
    3. Create an Authorization Module and Authorization Guard<\/strong><\/h5>\n
    With an authorization guard, we would protect certain endpoints. This means that to access this endpoints, and authorization token will be required.<\/p>\n
    Step 1<\/strong> – Generate authorization module using the command below:<\/p>\n
    <\/p>\n
    nest generate module authorization --no-spec\r\n<\/pre>\n
     <\/p>\n
    Step 2<\/strong> – Generate an authorization guard using the command below:
    \n<\/p>\n
    nest generate guard authorization --no-spec\r\n<\/pre>\n
     <\/p>\n
    Step 3<\/strong> – (optional) – Move the authorization guard into the authorization folder<\/p>\n
    Step 4<\/strong> – Install the following dependency:<\/p>\n
    npm install jwks-rsa express-jwt\r\n<\/pre>\n
     <\/p>\n
    4. Modify the Authorization Guard<\/strong><\/h5>\n
    We now need open the authorization guard file and make some changes<\/p>\n
    Step 1<\/strong> – Add the following imports while removing the observable import<\/p>\n
    import<\/span> { expressJwtSecret, GetVerificationKey } from 'jwks-rsa'<\/span>;\r\nimport<\/span> {promisify} from 'util'<\/span>;\r\nimport<\/span> {expressjwt} from 'express-jwt'<\/span>;\r\n<\/pre>\n
     <\/p>\n
    Step 2<\/strong> – Inside the canActivate function, create a checkJwt function like shown below:<\/p>\n
      const<\/span> checkJwt =<\/span> promisify(\r\n    jwt({\r\n      secret: expressJwtSecret<\/span>({\r\n        cache: true<\/span>,\r\n        rateLimit: true<\/span>,\r\n        jwksRequestsPerMinute: 5<\/span>,\r\n        jwksUri:<\/span> ''<\/span>,\r\n      }) as GetVerificationKey,\r\n      audience:<\/span> ''<\/span>,\r\n      issuer:<\/span> ''<\/span>,\r\n      algorithms:<\/span> ['RS256'<\/span>]\r\n    }),\r\n  );\r\n<\/pre>\n
     <\/p>\n
    Step 3<\/strong> – Replace the return true line with the code below:<\/p>\n
    try<\/span>{\r\n  await checkJwt(req, res);\r\n  return<\/span> true<\/span>;\r\n} catch<\/span>(error) {\r\n  throw<\/span> new<\/span> UnauthorizedException(error);\r\n}\r\n<\/pre>\n
     <\/p>\n
    Step 4<\/strong> – Change the canActivate function to an async function<\/p>\n
     <\/p>\n
    5. Create a New API for Auth0<\/strong><\/h5>\n
    Now this part is very important as you need to complete it to continue with the next steps.<\/p>\n
    Step 1<\/strong> – Visit https:\/\/manage.auth0.com\/<\/a> and create an account free.<\/p>\n
    Step 2<\/strong> – In your terminal, install Auth0 cli using the command below:<\/p>\n
    brew install auth0\/auth0-cli\/auth0\r\n<\/pre>\n
    This command is for Mac. For Auth0 cli installation on Windows or Linux, see procedure here.<\/p>\n
    Step 3<\/strong> – In your application terminal run the following to install the deploy cli<\/p>\n
    npm i -g auth0-deploy-cli\r\n<\/pre>\n
     <\/p>\n
    Step 4<\/strong> – Run the following command to create a new\u00a0 Auth0 API<\/p>\n
    auth0 apis create\r\n<\/pre>\n
    Provide a name for it nest-api-demo<\/p>\n
    You will notice that the auth0 api is created with the domain kindson.eu.auth0.com (yours may be different, so watch the video for clarification)<\/p>\n
     <\/p>\n
    6. Let’s Use a .env File<\/strong><\/h5>\n
    We would have to create a .env file and add our variables in it.<\/p>\n
    Step 1<\/strong> – Create a .env file<\/p>\n
    Step 2<\/strong> – Add the following in it.<\/p>\n
    AUTH0_AUDIENCE=nest-api-demo\r\nAUTH0_DOMAIN=https:\/\/kindson.eu.auth0.com\/\r\n<\/pre>\n
     <\/p>\n
    Step 3<\/strong> – To use the environment variables, install the nest config library using the command below:<\/p>\n
    npm install @nestjs\/config\r\n<\/pre>\n
     <\/p>\n
    Step 4<\/strong> – Import the config into the authorization guard file like so:
    \n<\/p>\n
    import<\/span> { ConfigService } from '@nestjs\/config'<\/span>;\r\n<\/pre>\n
     <\/p>\n
    Step 5<\/strong> – Add the ConfigModule to the imports section of the app module like so:<\/p>\n
    imports:<\/span> [AuthorizationModule, ConfigModule.forRoot()],\r\n<\/pre>\n
     <\/p>\n
    7. Add the ConfigService to the Authorization Guard<\/strong><\/h5>\n
    To use the ConfigService in the Authorization Guard, follow the steps below:<\/p>\n
    Step 1<\/strong> – Create two variables\u00a0 to hold the values of the AUTH0_AUDIENCE and the AUTH0_DOMAIN like so:<\/p>\n
    private<\/span> AUTH0_AUDIENCE: string<\/span>;\r\nprivate<\/span> AUTH0_DOMAIN: string<\/span>;\r\n<\/pre>\n
     <\/p>\n
    Step 2<\/strong>\u00a0– Create a constructor in the authorization.guard.ts file and inject the ConfigService like so:<\/p>\n
    constructor<\/span>( private<\/span> configService: ConfigService<\/span>){\r\n  this<\/span>.AUTH0_AUDIENCE =<\/span> this<\/span>.configService.get('AUTH0_AUDIENCE'<\/span>);\r\n  this<\/span>.AUTH0_DOMAIN =<\/span> this<\/span>.configService.get('AUTH0_DOMAIN'<\/span>);\r\n}\r\n<\/pre>\n
     <\/p>\n
    Step 3<\/strong> – Now update the jwt audience, issuer(domain) and the jwt secret jwkUri. Modified part of the code is given below:<\/p>\n
    ...\r\n  jwksUri:<\/span> `<\/span>${this<\/span>.AUTH0_DOMAIN}.well-<\/span>known\/<\/span>jwks.json`<\/span>,\r\n}),\r\naudience: this.AUTH0_AUDIENCE<\/span>,\r\nissuer: this.AUTH0_DOMAIN<\/span>,\r\n...\r\n<\/pre>\n
     <\/p>\n
    8. Finally, to protect and api endpoint,<\/strong><\/h5>\n
    Simply add this annotation to the controller endpoint:<\/p>\n
    @UseGuards(AuthorizationGuard)\r\n<\/pre>\n
     <\/p>\n
    At this point,\u00a0 you can now start the server and try to access the api endpoints. You’ll see that that protected endpoint would require authorization. This response is shown below using Postman<\/p>\n
    \"Accessing<\/a>
    Accessing protected resource using Auth0<\/figcaption><\/figure>\n
     <\/p>\n
    You can get the jwt token from your Auth0 dashboard and include it in the request and then you can access it.<\/p>\n","protected":false},"excerpt":{"rendered":"
    In this step by step tutorial, you will learn how to secure your REST API endpoints using Auth0. Create a NestJs Application Add Two More … <\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"pagelayer_contact_templates":[],"_pagelayer_content":"","footnotes":""},"categories":[414],"tags":[],"class_list":["post-1987","post","type-post","status-publish","format-standard","hentry","category-programming"],"_links":{"self":[{"href":"https:\/\/kindsonthegenius.com\/blog\/wp-json\/wp\/v2\/posts\/1987","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/kindsonthegenius.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/kindsonthegenius.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/kindsonthegenius.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/kindsonthegenius.com\/blog\/wp-json\/wp\/v2\/comments?post=1987"}],"version-history":[{"count":1,"href":"https:\/\/kindsonthegenius.com\/blog\/wp-json\/wp\/v2\/posts\/1987\/revisions"}],"predecessor-version":[{"id":2155,"href":"https:\/\/kindsonthegenius.com\/blog\/wp-json\/wp\/v2\/posts\/1987\/revisions\/2155"}],"wp:attachment":[{"href":"https:\/\/kindsonthegenius.com\/blog\/wp-json\/wp\/v2\/media?parent=1987"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/kindsonthegenius.com\/blog\/wp-json\/wp\/v2\/categories?post=1987"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/kindsonthegenius.com\/blog\/wp-json\/wp\/v2\/tags?post=1987"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}