Tesseral for Express.js

Tesseral’s Express SDK lets you add authentication to your Express.js backend.

The Tesseral Express SDK is open-source and available on GitHub.

Getting Started

Install the Tesseral Express SDK by running:

$
npm install @tesseral/tesseral-express

Then, in the file where you create your Express server, apply the requireAuth middleware:

1
import express from "express";
2
import { requireAuth } from "@tesseral/tesseral-express";
3
4
const app = express();
5
6
// before
7
// app.listen(...)
8
9
// after
10
app.use(
11
  requireAuth({
12
    publishableKey: "publishable_key_...",
13
  }),
14
);
15
16
app.listen(8080, "localhost", () => {
17
  console.log("Listening on http://localhost:8080");
18
});

Replace publishable_key_... with your project’s Publishable Key. You can find it in the API Keys Settings of the Tesseral Console.

Once you’ve added requireAuth, all HTTP requests to your server will be authenticated. Inauthentic requests will receive a 401 Unauthorized error before they reach your route handlers.

Accessing details about the authenticated request

The Tesseral middleware attaches information about the authenticated request directly to req. Use the helper functions from @tesseral/tesseral-express to access this data.

1
import { organizationId } from "@tesseral/tesseral-express";
2
3
app.get("/", (req, res) => {
4
  console.log(`you work for ${organizationId(req)}`)
5
});

Getting the current Organization

To access the Organization the request is for, use organizationId(req):

1
import { organizationId } from "@tesseral/tesseral-express";
2
3
organizationId(req); // returns a string like "org_..."

This is the most common identifier you’ll use in a B2B SaaS application.

Getting the request’s authenticated credentials

Anywhere your code wants to forward along the request’s credentials, use credentials(req):

1
import { credentials } from "@tesseral/tesseral-express";
2
3
credentials(req);

Do not log or expose this value. You usually don’t need to use this unless you’re building internal service-to-service calls.

Getting details about the current User

To access extra details about the authenticated User, use accessTokenClaims(req):

1
import { accessTokenClaims } from "@tesseral/tesseral-express";
2
3
const claims = accessTokenClaims(req);
4
5
console.log("User email:", claims.user.email);

accessTokenClaims returns an AccessTokenClaims, which contains details about the current Session ID, User, and Organization.

If the request if from an API Key, then accessTokenClaims will throw a NotAnAccessTokenError.

We recommend that you mostly use organizationId(req) in the vast majority of your code; that is almost always the correct piece of information for most B2B SaaS code should pay attention to. For more details, see B2B Multitenancy.