├── LICENSE.md ├── README.md ├── client ├── .env.example ├── .eslintrc.cjs ├── .gitignore ├── README.md ├── bun.lockb ├── index.html ├── package.json ├── pnpm-lock.yaml ├── postcss.config.js ├── public │ └── thirdweb.svg ├── src │ ├── assets │ │ └── thirdweb-logo.png │ ├── components │ │ ├── ConnectButtonAuth.tsx │ │ └── ContentCard.tsx │ ├── index.css │ ├── lib │ │ ├── api.ts │ │ └── client.ts │ ├── main.tsx │ └── vite-env.d.ts ├── tailwind.config.js ├── tsconfig.json ├── tsconfig.node.json └── vite.config.ts ├── package.json └── server ├── .env.example ├── .gitignore ├── README.md ├── bun.lockb ├── package.json ├── server.ts ├── thirdwebClient.ts └── tsconfig.json /LICENSE.md: -------------------------------------------------------------------------------- 1 | Apache License 2 | Version 2.0, January 2004 3 | http://www.apache.org/licenses/ 4 | 5 | TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION 6 | 7 | 1. Definitions. 8 | 9 | "License" shall mean the terms and conditions for use, reproduction, 10 | and distribution as defined by Sections 1 through 9 of this document. 11 | 12 | "Licensor" shall mean the copyright owner or entity authorized by 13 | the copyright owner that is granting the License. 14 | 15 | "Legal Entity" shall mean the union of the acting entity and all 16 | other entities that control, are controlled by, or are under common 17 | control with that entity. For the purposes of this definition, 18 | "control" means (i) the power, direct or indirect, to cause the 19 | direction or management of such entity, whether by contract or 20 | otherwise, or (ii) ownership of fifty percent (50%) or more of the 21 | outstanding shares, or (iii) beneficial ownership of such entity. 22 | 23 | "You" (or "Your") shall mean an individual or Legal Entity 24 | exercising permissions granted by this License. 25 | 26 | "Source" form shall mean the preferred form for making modifications, 27 | including but not limited to software source code, documentation 28 | source, and configuration files. 29 | 30 | "Object" form shall mean any form resulting from mechanical 31 | transformation or translation of a Source form, including but 32 | not limited to compiled object code, generated documentation, 33 | and conversions to other media types. 34 | 35 | "Work" shall mean the work of authorship, whether in Source or 36 | Object form, made available under the License, as indicated by a 37 | copyright notice that is included in or attached to the work 38 | (an example is provided in the Appendix below). 39 | 40 | "Derivative Works" shall mean any work, whether in Source or Object 41 | form, that is based on (or derived from) the Work and for which the 42 | editorial revisions, annotations, elaborations, or other modifications 43 | represent, as a whole, an original work of authorship. For the purposes 44 | of this License, Derivative Works shall not include works that remain 45 | separable from, or merely link (or bind by name) to the interfaces of, 46 | the Work and Derivative Works thereof. 47 | 48 | "Contribution" shall mean any work of authorship, including 49 | the original version of the Work and any modifications or additions 50 | to that Work or Derivative Works thereof, that is intentionally 51 | submitted to Licensor for inclusion in the Work by the copyright owner 52 | or by an individual or Legal Entity authorized to submit on behalf of 53 | the copyright owner. For the purposes of this definition, "submitted" 54 | means any form of electronic, verbal, or written communication sent 55 | to the Licensor or its representatives, including but not limited to 56 | communication on electronic mailing lists, source code control systems, 57 | and issue tracking systems that are managed by, or on behalf of, the 58 | Licensor for the purpose of discussing and improving the Work, but 59 | excluding communication that is conspicuously marked or otherwise 60 | designated in writing by the copyright owner as "Not a Contribution." 61 | 62 | "Contributor" shall mean Licensor and any individual or Legal Entity 63 | on behalf of whom a Contribution has been received by Licensor and 64 | subsequently incorporated within the Work. 65 | 66 | 2. Grant of Copyright License. Subject to the terms and conditions of 67 | this License, each Contributor hereby grants to You a perpetual, 68 | worldwide, non-exclusive, no-charge, royalty-free, irrevocable 69 | copyright license to reproduce, prepare Derivative Works of, 70 | publicly display, publicly perform, sublicense, and distribute the 71 | Work and such Derivative Works in Source or Object form. 72 | 73 | 3. Grant of Patent License. Subject to the terms and conditions of 74 | this License, each Contributor hereby grants to You a perpetual, 75 | worldwide, non-exclusive, no-charge, royalty-free, irrevocable 76 | (except as stated in this section) patent license to make, have made, 77 | use, offer to sell, sell, import, and otherwise transfer the Work, 78 | where such license applies only to those patent claims licensable 79 | by such Contributor that are necessarily infringed by their 80 | Contribution(s) alone or by combination of their Contribution(s) 81 | with the Work to which such Contribution(s) was submitted. If You 82 | institute patent litigation against any entity (including a 83 | cross-claim or counterclaim in a lawsuit) alleging that the Work 84 | or a Contribution incorporated within the Work constitutes direct 85 | or contributory patent infringement, then any patent licenses 86 | granted to You under this License for that Work shall terminate 87 | as of the date such litigation is filed. 88 | 89 | 4. Redistribution. You may reproduce and distribute copies of the 90 | Work or Derivative Works thereof in any medium, with or without 91 | modifications, and in Source or Object form, provided that You 92 | meet the following conditions: 93 | 94 | (a) You must give any other recipients of the Work or 95 | Derivative Works a copy of this License; and 96 | 97 | (b) You must cause any modified files to carry prominent notices 98 | stating that You changed the files; and 99 | 100 | (c) You must retain, in the Source form of any Derivative Works 101 | that You distribute, all copyright, patent, trademark, and 102 | attribution notices from the Source form of the Work, 103 | excluding those notices that do not pertain to any part of 104 | the Derivative Works; and 105 | 106 | (d) If the Work includes a "NOTICE" text file as part of its 107 | distribution, then any Derivative Works that You distribute must 108 | include a readable copy of the attribution notices contained 109 | within such NOTICE file, excluding those notices that do not 110 | pertain to any part of the Derivative Works, in at least one 111 | of the following places: within a NOTICE text file distributed 112 | as part of the Derivative Works; within the Source form or 113 | documentation, if provided along with the Derivative Works; or, 114 | within a display generated by the Derivative Works, if and 115 | wherever such third-party notices normally appear. The contents 116 | of the NOTICE file are for informational purposes only and 117 | do not modify the License. You may add Your own attribution 118 | notices within Derivative Works that You distribute, alongside 119 | or as an addendum to the NOTICE text from the Work, provided 120 | that such additional attribution notices cannot be construed 121 | as modifying the License. 122 | 123 | You may add Your own copyright statement to Your modifications and 124 | may provide additional or different license terms and conditions 125 | for use, reproduction, or distribution of Your modifications, or 126 | for any such Derivative Works as a whole, provided Your use, 127 | reproduction, and distribution of the Work otherwise complies with 128 | the conditions stated in this License. 129 | 130 | 5. Submission of Contributions. Unless You explicitly state otherwise, 131 | any Contribution intentionally submitted for inclusion in the Work 132 | by You to the Licensor shall be under the terms and conditions of 133 | this License, without any additional terms or conditions. 134 | Notwithstanding the above, nothing herein shall supersede or modify 135 | the terms of any separate license agreement you may have executed 136 | with Licensor regarding such Contributions. 137 | 138 | 6. Trademarks. This License does not grant permission to use the trade 139 | names, trademarks, service marks, or product names of the Licensor, 140 | except as required for reasonable and customary use in describing the 141 | origin of the Work and reproducing the content of the NOTICE file. 142 | 143 | 7. Disclaimer of Warranty. Unless required by applicable law or 144 | agreed to in writing, Licensor provides the Work (and each 145 | Contributor provides its Contributions) on an "AS IS" BASIS, 146 | WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or 147 | implied, including, without limitation, any warranties or conditions 148 | of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A 149 | PARTICULAR PURPOSE. You are solely responsible for determining the 150 | appropriateness of using or redistributing the Work and assume any 151 | risks associated with Your exercise of permissions under this License. 152 | 153 | 8. Limitation of Liability. In no event and under no legal theory, 154 | whether in tort (including negligence), contract, or otherwise, 155 | unless required by applicable law (such as deliberate and grossly 156 | negligent acts) or agreed to in writing, shall any Contributor be 157 | liable to You for damages, including any direct, indirect, special, 158 | incidental, or consequential damages of any character arising as a 159 | result of this License or out of the use or inability to use the 160 | Work (including but not limited to damages for loss of goodwill, 161 | work stoppage, computer failure or malfunction, or any and all 162 | other commercial damages or losses), even if such Contributor 163 | has been advised of the possibility of such damages. 164 | 165 | 9. Accepting Warranty or Additional Liability. While redistributing 166 | the Work or Derivative Works thereof, You may choose to offer, 167 | and charge a fee for, acceptance of support, warranty, indemnity, 168 | or other liability obligations and/or rights consistent with this 169 | License. However, in accepting such obligations, You may act only 170 | on Your own behalf and on Your sole responsibility, not on behalf 171 | of any other Contributor, and only if You agree to indemnify, 172 | defend, and hold each Contributor harmless for any liability 173 | incurred by, or claims asserted against, such Contributor by reason 174 | of your accepting any such warranty or additional liability. 175 | 176 | END OF TERMS AND CONDITIONS 177 | 178 | APPENDIX: How to apply the Apache License to your work. 179 | 180 | To apply the Apache License to your work, attach the following 181 | boilerplate notice, with the fields enclosed by brackets "[]" 182 | replaced with your own identifying information. (Don't include 183 | the brackets!) The text should be enclosed in the appropriate 184 | comment syntax for the file format. We also recommend that a 185 | file or class name and description of purpose be included on the 186 | same "printed page" as the copyright notice for easier 187 | identification within third-party archives. 188 | 189 | Copyright 2021 Non-Fungible Labs, Inc 190 | 191 | Licensed under the Apache License, Version 2.0 (the "License"); 192 | you may not use this file except in compliance with the License. 193 | You may obtain a copy of the License at 194 | 195 | http://www.apache.org/licenses/LICENSE-2.0 196 | 197 | Unless required by applicable law or agreed to in writing, software 198 | distributed under the License is distributed on an "AS IS" BASIS, 199 | WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 200 | See the License for the specific language governing permissions and 201 | limitations under the License. 202 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | ![Group 1](https://github.com/thirdweb-example/thirdweb-auth-express/assets/17715009/06383e68-9c65-4265-8505-e88e573443f9) 2 | 3 | # React + Express Auth Starter Template 4 | 5 | [thirdweb SDK](https://www.npmjs.com/package/thirdweb) 6 | [Discord](https://discord.gg/thirdweb) 7 | 8 | The template is a standard monorepo separated into a client and a server. The client is a React app using Vite and the server is an Express app. Both the server and client use TypeScript and Bun (can be substituted for npm, yarn, or pnpm). 9 | 10 | The client uses thirdweb's Auth SDK to communicate with the server via your own routes. When a user is authenticated, the server returns a JWT which the client can cache for future requests. Thirdweb's Auth SDK takes care of the difficult pieces like payload generation and signing while allowing you to control how authentication happens between your backend and frontend. 11 | 12 | ## Getting Started 13 | 14 | > Note, all commands can be substituted with npm, yarn, or pnpm if preferred. 15 | 16 | First, install dependencies on both the client and server: 17 | 18 | ```bash 19 | cd client && bun install 20 | cd server && bun install 21 | ``` 22 | 23 | ### Environment variables 24 | 25 | Copy the `.env.example` files to `.env`: 26 | 27 | ```bash 28 | cp client/.env.example client/.env 29 | cp server/.env.example server/.env 30 | ``` 31 | 32 | In each `.env` file, complete any necessary values. There are comments in each `.env.example` file explaining what each value does. 33 | 34 | ### Running the app 35 | 36 | Then, run the client and server in development mode: 37 | 38 | ```bash 39 | cd client && bun run dev 40 | cd server && bun run dev 41 | ``` 42 | 43 | Or from the root directory: 44 | 45 | ```bash 46 | bun run client 47 | bun run server 48 | ``` 49 | 50 | ## How it works 51 | 52 | All authentication logic happens in just two files: one in the client, and one on the server. 53 | 54 | On the client, `ConnectButtonAuth.tsx` uses the thirdweb `ConnectButton` to specify the `auth` object, which contains the callbacks to manage all auth requests your application makes. This same process can be done with your own custom components using the underlying functions in `thirdweb/auth`. The connect button is a template for the four functions every application's auth needs to implement: 55 | 56 | - `isLoggedIn` checks whether or not the current user is logged in, the criteria for this is up to you but the default uses a JWT in local cookie storage 57 | - `getLoginPayload` retrieves the message to sign for login from the server. The function to generate this payload is provided for you in the SDK, you simply need to send it to the server 58 | - `doLogin` attempts to log the user with a signed payload. Normally, this involves sending the payload to your Express server. 59 | - `doLogout` logs the user out. This function is entirely up to you and is based on how you handle authentication. In this app for example, it clears the local storage. 60 | 61 | > Note: All complex logic such as generating and signing payloads, caching and invalidating state, and more is handled for you by the SDK. Even if you're using your own components, thirdweb provides the underlying functions to execute these steps. Check out our documentation to learn more. 62 | 63 | On the server, `server.ts` handles all routes for the app. The SDK provides a number of useful functions to keep your backend routes as simple as possible: 64 | 65 | - `generatePayload` generates a login payload for a given user address. This is the message the user's accont signs on the client and returns to the server for verification. 66 | - `verifyPayload` verifies the user's signed payload to either log them in, or reject the attempt. 67 | - `generateJWT` won't always be needed, but is a helpful function to generate a JWT for the user to use as in cookies or client-side storage to cache the user's session 68 | - `verifyJWT` checks if a given JWT is valid when authenticating requests. 69 | 70 | ## Documentation 71 | 72 | - [TypeScript SDK](https://portal.thirdweb.com/typescript/v5) 73 | - [Sign in with Ethereum Spec](https://eips.ethereum.org/EIPS/eip-4361) 74 | - [Express Docs](https://expressjs.com/) 75 | 76 | ## Support 77 | 78 | For help or feedback, please [visit our support site](https://thirdweb.com/support) 79 | -------------------------------------------------------------------------------- /client/.env.example: -------------------------------------------------------------------------------- 1 | THIRDWEB_CLIENT_ID= # Get this from https://thirdweb.com/dashboard/settings/api-keys 2 | AUTH_API=http://localhost:3000 3 | -------------------------------------------------------------------------------- /client/.eslintrc.cjs: -------------------------------------------------------------------------------- 1 | module.exports = { 2 | root: true, 3 | env: { browser: true, es2020: true }, 4 | extends: [ 5 | "eslint:recommended", 6 | "plugin:@typescript-eslint/recommended", 7 | "plugin:react-hooks/recommended", 8 | ], 9 | ignorePatterns: ["dist", ".eslintrc.cjs"], 10 | parser: "@typescript-eslint/parser", 11 | plugins: ["react-refresh"], 12 | rules: { 13 | "react-refresh/only-export-components": [ 14 | "warn", 15 | { allowConstantExport: true }, 16 | ], 17 | }, 18 | }; 19 | -------------------------------------------------------------------------------- /client/.gitignore: -------------------------------------------------------------------------------- 1 | # Logs 2 | logs 3 | *.log 4 | npm-debug.log* 5 | yarn-debug.log* 6 | yarn-error.log* 7 | pnpm-debug.log* 8 | lerna-debug.log* 9 | 10 | .env 11 | .env.local 12 | node_modules 13 | dist 14 | dist-ssr 15 | *.local 16 | 17 | # Editor directories and files 18 | .vscode/* 19 | !.vscode/extensions.json 20 | .idea 21 | .DS_Store 22 | *.suo 23 | *.ntvs* 24 | *.njsproj 25 | *.sln 26 | *.sw? 27 | -------------------------------------------------------------------------------- /client/README.md: -------------------------------------------------------------------------------- 1 | # Client App 2 | 3 | To install dependencies: 4 | 5 | ```bash 6 | bun install 7 | ``` 8 | 9 | To run: 10 | 11 | ```bash 12 | bun run dev 13 | ``` 14 | 15 | To build for production: 16 | 17 | ```bash 18 | bun run build 19 | ``` 20 | -------------------------------------------------------------------------------- /client/bun.lockb: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/thirdweb-example/thirdweb-auth-express/81bd6efb87c3f19721d85bfdd48d7c3c0765b6d9/client/bun.lockb -------------------------------------------------------------------------------- /client/index.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | React + Express Auth Starter Template 8 | 9 | 10 |
11 | 12 | 13 | 14 | -------------------------------------------------------------------------------- /client/package.json: -------------------------------------------------------------------------------- 1 | { 2 | "name": "client", 3 | "private": true, 4 | "version": "0.0.0", 5 | "type": "module", 6 | "scripts": { 7 | "dev": "bunx --bun vite", 8 | "build": "bunx --bun vite build", 9 | "lint": "eslint . --ext ts,tsx --report-unused-disable-directives --max-warnings 0" 10 | }, 11 | "dependencies": { 12 | "classnames": "^2.5.1", 13 | "react": "^18.2.0", 14 | "react-dom": "^18.2.0", 15 | "thirdweb": "^5.14.0" 16 | }, 17 | "devDependencies": { 18 | "@types/node": "^20.12.7", 19 | "@types/react": "^18.2.66", 20 | "@types/react-dom": "^18.2.22", 21 | "@typescript-eslint/eslint-plugin": "^7.2.0", 22 | "@typescript-eslint/parser": "^7.2.0", 23 | "@vitejs/plugin-react-swc": "^3.5.0", 24 | "autoprefixer": "^10.4.19", 25 | "eslint": "^8.57.0", 26 | "eslint-plugin-react-hooks": "^4.6.0", 27 | "eslint-plugin-react-refresh": "^0.4.6", 28 | "postcss": "^8.4.38", 29 | "tailwindcss": "^3.4.3", 30 | "typescript": "^5.2.2", 31 | "vite": "^5.2.0" 32 | } 33 | } 34 | -------------------------------------------------------------------------------- /client/postcss.config.js: -------------------------------------------------------------------------------- 1 | export default { 2 | plugins: { 3 | tailwindcss: {}, 4 | autoprefixer: {}, 5 | }, 6 | } 7 | -------------------------------------------------------------------------------- /client/public/thirdweb.svg: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | -------------------------------------------------------------------------------- /client/src/assets/thirdweb-logo.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/thirdweb-example/thirdweb-auth-express/81bd6efb87c3f19721d85bfdd48d7c3c0765b6d9/client/src/assets/thirdweb-logo.png -------------------------------------------------------------------------------- /client/src/components/ConnectButtonAuth.tsx: -------------------------------------------------------------------------------- 1 | import { ConnectButton } from "thirdweb/react"; 2 | import { client } from "../lib/client"; 3 | import { LoginPayload, VerifyLoginPayloadParams } from "thirdweb/auth"; 4 | import { get, post } from "../lib/api"; 5 | import { sepolia } from "thirdweb/chains"; 6 | 7 | export default function ConnectButtonAuth() { 8 | return ( 9 | => { 29 | return get({ 30 | url: process.env.AUTH_API + "/login", 31 | params: { 32 | address: params.address, 33 | chainId: sepolia.id.toString(), 34 | }, 35 | }); 36 | }, 37 | /** 38 | * `doLogin` performs any logic necessary to log the user in using the signed payload. 39 | * In this case, this means sending the payload to the server for it to set a JWT cookie for the user. 40 | */ 41 | doLogin: async (params: VerifyLoginPayloadParams) => { 42 | await post({ 43 | url: process.env.AUTH_API + "/login", 44 | params, 45 | }); 46 | }, 47 | /** 48 | * `isLoggedIn` returns true or false to signal if the user is logged in. 49 | * Here, this is done by calling the server to check if the user has a valid JWT cookie set. 50 | */ 51 | isLoggedIn: async () => { 52 | return await get({ 53 | url: process.env.AUTH_API + "/isLoggedIn", 54 | }); 55 | }, 56 | /** 57 | * `doLogout` performs any logic necessary to log the user out. 58 | * In this case, this means sending a request to the server to clear the JWT cookie. 59 | */ 60 | doLogout: async () => { 61 | await post({ 62 | url: process.env.AUTH_API + "/logout", 63 | }); 64 | }, 65 | }} 66 | /> 67 | ); 68 | } 69 | -------------------------------------------------------------------------------- /client/src/components/ContentCard.tsx: -------------------------------------------------------------------------------- 1 | import thirdwebImageUrl from "../assets/thirdweb-logo.png"; 2 | 3 | export default function ContentCard({ 4 | children, 5 | content, 6 | }: { 7 | children: React.ReactNode; 8 | content: string; 9 | }) { 10 | return ( 11 |
12 |
13 | Thirdweb 18 | {children} 19 |
20 | {content} 21 |
22 |
23 |
24 |
25 | ); 26 | } 27 | -------------------------------------------------------------------------------- /client/src/index.css: -------------------------------------------------------------------------------- 1 | @tailwind base; 2 | @tailwind components; 3 | @tailwind utilities; 4 | 5 | .tw-gradient { 6 | @apply bg-gradient-to-tl from-[#6200C6] to-[#FF00A8]; 7 | } 8 | -------------------------------------------------------------------------------- /client/src/lib/api.ts: -------------------------------------------------------------------------------- 1 | type GetOptions = { 2 | url: string; 3 | params?: Record; 4 | headers?: Record; 5 | }; 6 | 7 | export async function get({ url, params, headers }: GetOptions) { 8 | const response = await fetch(url + "?" + new URLSearchParams(params), { 9 | method: "GET", 10 | headers, 11 | credentials: "include", 12 | }); 13 | 14 | if (!response.ok) { 15 | throw new Error(response.statusText); 16 | } 17 | 18 | return await response.json(); 19 | } 20 | 21 | type PostOptions = { 22 | url: string; 23 | params?: Record; 24 | headers?: Record; 25 | }; 26 | 27 | export async function post({ url, params, headers }: PostOptions) { 28 | const response = await fetch(url, { 29 | method: "POST", 30 | headers: { 31 | "Content-Type": "application/json", 32 | ...headers, 33 | }, 34 | body: JSON.stringify(params ?? {}), 35 | credentials: "include", 36 | }); 37 | 38 | if (!response.ok) { 39 | throw new Error(response.statusText); 40 | } 41 | 42 | return await response.json(); 43 | } 44 | -------------------------------------------------------------------------------- /client/src/lib/client.ts: -------------------------------------------------------------------------------- 1 | import { createThirdwebClient } from "thirdweb"; 2 | 3 | const clientId = process.env.THIRDWEB_CLIENT_ID!; 4 | 5 | export const client = createThirdwebClient({ clientId }); 6 | -------------------------------------------------------------------------------- /client/src/main.tsx: -------------------------------------------------------------------------------- 1 | import "./index.css"; 2 | import React from "react"; 3 | import ReactDOM from "react-dom/client"; 4 | import { ThirdwebProvider } from "thirdweb/react"; 5 | import ContentCard from "./components/ContentCard"; 6 | import ConnectButtonAuth from "./components/ConnectButtonAuth"; 7 | 8 | ReactDOM.createRoot(document.getElementById("root")!).render( 9 | 10 | 11 |
12 |
13 |
14 |
15 | React + Express{" "} 16 | 21 | thirdweb auth 22 | {" "} 23 | template. 24 |
25 | 26 | 27 | 28 | 29 |
30 |
31 | 40 |
41 | 42 | 43 | ); 44 | -------------------------------------------------------------------------------- /client/src/vite-env.d.ts: -------------------------------------------------------------------------------- 1 | /// 2 | -------------------------------------------------------------------------------- /client/tailwind.config.js: -------------------------------------------------------------------------------- 1 | /** @type {import('tailwindcss').Config} */ 2 | export default { 3 | content: ["./index.html", "./src/**/*.{js,ts,jsx,tsx}"], 4 | theme: { 5 | extend: {}, 6 | }, 7 | plugins: [], 8 | }; 9 | -------------------------------------------------------------------------------- /client/tsconfig.json: -------------------------------------------------------------------------------- 1 | { 2 | "compilerOptions": { 3 | "target": "ES2020", 4 | "useDefineForClassFields": true, 5 | "lib": ["ES2020", "DOM", "DOM.Iterable"], 6 | "module": "ESNext", 7 | "skipLibCheck": true, 8 | 9 | /* Bundler mode */ 10 | "moduleResolution": "bundler", 11 | "allowImportingTsExtensions": true, 12 | "resolveJsonModule": true, 13 | "isolatedModules": true, 14 | "noEmit": true, 15 | "jsx": "react-jsx", 16 | 17 | /* Linting */ 18 | "strict": true, 19 | "noUnusedLocals": true, 20 | "noUnusedParameters": true, 21 | "noFallthroughCasesInSwitch": true 22 | }, 23 | "include": ["src"], 24 | "references": [{ "path": "./tsconfig.node.json" }] 25 | } 26 | -------------------------------------------------------------------------------- /client/tsconfig.node.json: -------------------------------------------------------------------------------- 1 | { 2 | "compilerOptions": { 3 | "composite": true, 4 | "skipLibCheck": true, 5 | "module": "ESNext", 6 | "moduleResolution": "bundler", 7 | "allowSyntheticDefaultImports": true, 8 | "strict": true 9 | }, 10 | "include": ["vite.config.ts"] 11 | } 12 | -------------------------------------------------------------------------------- /client/vite.config.ts: -------------------------------------------------------------------------------- 1 | import { defineConfig } from "vite"; 2 | import react from "@vitejs/plugin-react-swc"; 3 | 4 | // https://vitejs.dev/config/ 5 | export default defineConfig({ 6 | plugins: [react()], 7 | define: { 8 | "process.env": process.env, 9 | }, 10 | }); 11 | -------------------------------------------------------------------------------- /package.json: -------------------------------------------------------------------------------- 1 | { 2 | "name": "thirdweb-auth-express", 3 | "repository": "https://github.com/thirdweb-example/thirdweb-auth-express.git", 4 | "license": "Apache-2.0", 5 | "scripts": { 6 | "client": "cd client && bun run dev", 7 | "server": "cd server && bun run dev" 8 | } 9 | } 10 | -------------------------------------------------------------------------------- /server/.env.example: -------------------------------------------------------------------------------- 1 | THIRDWEB_SECRET_KEY= # Get this at https://thirdweb.com/dashboard/settings/api-keys 2 | CLIENT_DOMAIN=localhost:5173 # The domain of your frontend (remember to update this in production) 3 | ADMIN_PRIVATE_KEY= # An admin wallet private key to generate the JWT with 4 | NODE_ENV=development # Change this to "production" when deploying 5 | -------------------------------------------------------------------------------- /server/.gitignore: -------------------------------------------------------------------------------- 1 | # Based on https://raw.githubusercontent.com/github/gitignore/main/Node.gitignore 2 | 3 | # Logs 4 | 5 | logs 6 | _.log 7 | npm-debug.log_ 8 | yarn-debug.log* 9 | yarn-error.log* 10 | lerna-debug.log* 11 | .pnpm-debug.log* 12 | 13 | # Caches 14 | 15 | .cache 16 | 17 | # Diagnostic reports (https://nodejs.org/api/report.html) 18 | 19 | report.[0-9]_.[0-9]_.[0-9]_.[0-9]_.json 20 | 21 | # Runtime data 22 | 23 | pids 24 | _.pid 25 | _.seed 26 | *.pid.lock 27 | 28 | # Directory for instrumented libs generated by jscoverage/JSCover 29 | 30 | lib-cov 31 | 32 | # Coverage directory used by tools like istanbul 33 | 34 | coverage 35 | *.lcov 36 | 37 | # nyc test coverage 38 | 39 | .nyc_output 40 | 41 | # Grunt intermediate storage (https://gruntjs.com/creating-plugins#storing-task-files) 42 | 43 | .grunt 44 | 45 | # Bower dependency directory (https://bower.io/) 46 | 47 | bower_components 48 | 49 | # node-waf configuration 50 | 51 | .lock-wscript 52 | 53 | # Compiled binary addons (https://nodejs.org/api/addons.html) 54 | 55 | build/Release 56 | 57 | # Dependency directories 58 | 59 | node_modules/ 60 | jspm_packages/ 61 | 62 | # Snowpack dependency directory (https://snowpack.dev/) 63 | 64 | web_modules/ 65 | 66 | # TypeScript cache 67 | 68 | *.tsbuildinfo 69 | 70 | # Optional npm cache directory 71 | 72 | .npm 73 | 74 | # Optional eslint cache 75 | 76 | .eslintcache 77 | 78 | # Optional stylelint cache 79 | 80 | .stylelintcache 81 | 82 | # Microbundle cache 83 | 84 | .rpt2_cache/ 85 | .rts2_cache_cjs/ 86 | .rts2_cache_es/ 87 | .rts2_cache_umd/ 88 | 89 | # Optional REPL history 90 | 91 | .node_repl_history 92 | 93 | # Output of 'npm pack' 94 | 95 | *.tgz 96 | 97 | # Yarn Integrity file 98 | 99 | .yarn-integrity 100 | 101 | # dotenv environment variable files 102 | 103 | .env 104 | .env.development.local 105 | .env.test.local 106 | .env.production.local 107 | .env.local 108 | 109 | # parcel-bundler cache (https://parceljs.org/) 110 | 111 | .parcel-cache 112 | 113 | # Next.js build output 114 | 115 | .next 116 | out 117 | 118 | # Nuxt.js build / generate output 119 | 120 | .nuxt 121 | dist 122 | 123 | # Gatsby files 124 | 125 | # Comment in the public line in if your project uses Gatsby and not Next.js 126 | 127 | # https://nextjs.org/blog/next-9-1#public-directory-support 128 | 129 | # public 130 | 131 | # vuepress build output 132 | 133 | .vuepress/dist 134 | 135 | # vuepress v2.x temp and cache directory 136 | 137 | .temp 138 | 139 | # Docusaurus cache and generated files 140 | 141 | .docusaurus 142 | 143 | # Serverless directories 144 | 145 | .serverless/ 146 | 147 | # FuseBox cache 148 | 149 | .fusebox/ 150 | 151 | # DynamoDB Local files 152 | 153 | .dynamodb/ 154 | 155 | # TernJS port file 156 | 157 | .tern-port 158 | 159 | # Stores VSCode versions used for testing VSCode extensions 160 | 161 | .vscode-test 162 | 163 | # yarn v2 164 | 165 | .yarn/cache 166 | .yarn/unplugged 167 | .yarn/build-state.yml 168 | .yarn/install-state.gz 169 | .pnp.* 170 | 171 | # IntelliJ based IDEs 172 | .idea 173 | 174 | # Finder (MacOS) folder config 175 | .DS_Store 176 | -------------------------------------------------------------------------------- /server/README.md: -------------------------------------------------------------------------------- 1 | # Server App 2 | 3 | To install dependencies: 4 | 5 | ```bash 6 | bun install 7 | ``` 8 | 9 | To run: 10 | 11 | ```bash 12 | bun run start 13 | ``` 14 | 15 | To run in watch mode: 16 | 17 | ```bash 18 | bun run dev 19 | ``` 20 | -------------------------------------------------------------------------------- /server/bun.lockb: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/thirdweb-example/thirdweb-auth-express/81bd6efb87c3f19721d85bfdd48d7c3c0765b6d9/server/bun.lockb -------------------------------------------------------------------------------- /server/package.json: -------------------------------------------------------------------------------- 1 | { 2 | "name": "server", 3 | "module": "server.ts", 4 | "scripts": { 5 | "dev": "bun --watch server.ts", 6 | "start": "bun server.ts" 7 | }, 8 | "type": "module", 9 | "devDependencies": { 10 | "@types/bun": "latest", 11 | "@types/cookie-parser": "^1.4.7", 12 | "@types/cors": "^2.8.17", 13 | "@types/express": "^4.17.21" 14 | }, 15 | "peerDependencies": { 16 | "typescript": "^5.0.0" 17 | }, 18 | "dependencies": { 19 | "cookie-parser": "^1.4.6", 20 | "cors": "^2.8.5", 21 | "express": "^4.19.2", 22 | "thirdweb": "^5.14.0" 23 | } 24 | } 25 | -------------------------------------------------------------------------------- /server/server.ts: -------------------------------------------------------------------------------- 1 | import express from "express"; 2 | import cors from "cors"; 3 | import cookieParser from "cookie-parser"; 4 | import { createAuth, type VerifyLoginPayloadParams } from "thirdweb/auth"; 5 | import { privateKeyToAccount } from "thirdweb/wallets"; 6 | import { thirdwebClient } from "./thirdwebClient"; 7 | 8 | const app = express(); 9 | app.use(express.json()); 10 | app.use(cookieParser()); 11 | app.use( 12 | cors({ 13 | origin: `${ 14 | process.env.NODE_ENV === "development" ? "http" : "https" 15 | }://${process.env.CLIENT_DOMAIN}`, 16 | credentials: true, 17 | }) 18 | ); 19 | 20 | const thirdwebAuth = createAuth({ 21 | domain: process.env.CLIENT_DOMAIN!, 22 | client: thirdwebClient, 23 | adminAccount: privateKeyToAccount({ 24 | client: thirdwebClient, 25 | privateKey: process.env.ADMIN_PRIVATE_KEY!, 26 | }), 27 | }); 28 | 29 | app.get("/", (req, res) => { 30 | return res.send("Auth server is live"); 31 | }); 32 | 33 | app.get("/login", async (req, res) => { 34 | const address = req.query.address; 35 | const chainId = req.query.chainId as string | undefined; 36 | 37 | if (typeof address !== "string") { 38 | return res.status(400).send("Address is required"); 39 | } 40 | 41 | return res.send( 42 | await thirdwebAuth.generatePayload({ 43 | address, 44 | chainId: chainId ? parseInt(chainId) : undefined, 45 | }) 46 | ); 47 | }); 48 | 49 | app.post("/login", async (req, res) => { 50 | const payload: VerifyLoginPayloadParams = req.body; 51 | 52 | const verifiedPayload = await thirdwebAuth.verifyPayload(payload); 53 | 54 | if (verifiedPayload.valid) { 55 | const jwt = await thirdwebAuth.generateJWT({ 56 | payload: verifiedPayload.payload, 57 | }); 58 | res.cookie("jwt", jwt); 59 | return res.status(200).send({ token: jwt }); 60 | } 61 | 62 | res.status(400).send("Failed to login"); 63 | }); 64 | 65 | app.get("/isLoggedIn", async (req, res) => { 66 | const jwt = req.cookies?.jwt; 67 | 68 | if (!jwt) { 69 | return res.send(false); 70 | } 71 | 72 | const authResult = await thirdwebAuth.verifyJWT({ jwt }); 73 | 74 | if (!authResult.valid) { 75 | return res.send(false); 76 | } 77 | 78 | return res.send(true); 79 | }); 80 | 81 | app.post("/logout", (req, res) => { 82 | res.clearCookie("jwt"); 83 | return res.send(true); 84 | }); 85 | 86 | app.listen(3000, () => { 87 | console.log(`⚡ Auth server listening on port 3000...`); 88 | }); 89 | -------------------------------------------------------------------------------- /server/thirdwebClient.ts: -------------------------------------------------------------------------------- 1 | import { createThirdwebClient } from "thirdweb"; 2 | 3 | const secretKey = process.env.THIRDWEB_SECRET_KEY!; 4 | 5 | export const thirdwebClient = createThirdwebClient({ secretKey }); 6 | -------------------------------------------------------------------------------- /server/tsconfig.json: -------------------------------------------------------------------------------- 1 | { 2 | "compilerOptions": { 3 | // Enable latest features 4 | "lib": ["ESNext", "DOM"], 5 | "target": "ESNext", 6 | "module": "ESNext", 7 | "moduleDetection": "force", 8 | "jsx": "react-jsx", 9 | "allowJs": true, 10 | 11 | // Bundler mode 12 | "moduleResolution": "bundler", 13 | "allowImportingTsExtensions": true, 14 | "verbatimModuleSyntax": true, 15 | "noEmit": true, 16 | 17 | // Best practices 18 | "strict": true, 19 | "skipLibCheck": true, 20 | "noFallthroughCasesInSwitch": true, 21 | 22 | // Some stricter flags (disabled by default) 23 | "noUnusedLocals": false, 24 | "noUnusedParameters": false, 25 | "noPropertyAccessFromIndexSignature": false 26 | } 27 | } 28 | --------------------------------------------------------------------------------