> ## Documentation Index
> Fetch the complete documentation index at: https://docs-test.rye.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# JWT Authentication

> Enhance your app's security through the use of short-lived access tokens.

## How It Works

<Steps>
  <Step title="Generate an RSA key pair">
    <CodeGroup>
      ```bash shell theme={null}
      openssl genpkey -algorithm RSA -out private_key.pem -pkeyopt rsa_keygen_bits:2048
      openssl rsa -pubout -in private_key.pem -out public_key.pem
      ```
    </CodeGroup>

    Store your private key securely. You will need it to sign access tokens later.
  </Step>

  <Step title="Setup your account">
    Log in to [https://console.rye.com](https://console.rye.com/account), and update the public key field in your account settings.

    <img src="https://mintcdn.com/rye-35/j7SfJ8CcimgGEE8U/images/jwt-validation.png?fit=max&auto=format&n=j7SfJ8CcimgGEE8U&q=85&s=bb2222fdd21d521dd72878ba1f858d4f" alt="" width="1794" height="776" data-path="images/jwt-validation.png" />
  </Step>

  <Step title="Generate access tokens">
    Create an endpoint within your backend system designed to generate and provide access tokens for your frontend application.

    <CodeGroup>
      ```typescript TypeScript theme={null}
        import jwt from 'jsonwebtoken';

        function generateToken(): string {
          return jwt.sign(
            {},
            RSA_PRIVATE_KEY,          // The private key generated in Step 1.
            {
              algorithm: 'RS256',
              expiresIn: '1h',        // Rye's policy restricts TTL durations to a maximum of one hour.
              audience: JWT_AUDIENCE, // graphql.api.rye.com for production, staging.graphql.api.rye.com for staging.
              issuer: JWT_ISSUER,     // Your unique issuer value can be found in the Rye console under the Account tab. Note this value is unique per environment (staging vs production)
            }
          );
        }
      ```
    </CodeGroup>
  </Step>

  <Step title="Use the access token">
    Include the access token within the Authorization header for any requests made to the Rye API.

    <CodeGroup>
      ```typescript TypeScript theme={null}
        const response = await axios.post(
          RYE_API_ENDPOINT,
          GRAPHQL_REQUEST_BODY,
          {
            headers: {
              'Authorization': `Bearer ${JWT_TOKEN}`,
              'Content-Type': 'application/json',
            },
          }
        );
      ```
    </CodeGroup>

    <Note>
      When utilizing JWT authentication, there's no need to include the `Rye-Shopper-IP` header in your requests, as Rye will automatically use the client's IP address.
    </Note>
  </Step>
</Steps>