> ## Documentation Index
> Fetch the complete documentation index at: https://docs.commerce.jolly.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# JWT Authentication

> Enhance your app's security through the use of short-lived access tokens.

## How It Works

**1. Generate an RSA key pair**

```bash shell theme={null}
openssl genpkey -algorithm RSA -out private_key.pem -pkeyopt rsa_keygen_bits:2048
openssl rsa -pubout -in private_key.pem -out public_key.pem
```

Store your private key securely. You will need it to sign access tokens later.

**2. Setup your account**

Log in to [https://console.commerce.jolly.dev](https://console.commerce.jolly.dev/account), and update the public key field in your account settings.

![](https://mintcdn.com/jolly-commerce/2QIqebHt5agkP3jl/images/jwt-validation.png?fit=max\&auto=format\&n=2QIqebHt5agkP3jl\&q=85\&s=244c2f8333bb75c88e9327e341f09cf4)

**3. Generate access tokens**

Create an endpoint within your backend system designed to generate and provide access tokens for your frontend application.

```typescript TypeScript theme={null}
  import jwt from 'jsonwebtoken';

  function generateToken(): string {
    return jwt.sign(
      {},
      RSA_PRIVATE_KEY,          // The private key generated in Step 1.
      {
        algorithm: 'RS256',
        expiresIn: '1h',        // Rye's policy restricts TTL durations to a maximum of one hour.
        audience: JWT_AUDIENCE, // graphql.api.rye.com for production, staging.graphql.api.rye.com for staging.
        issuer: JWT_ISSUER,     // Your unique issuer value can be found in the Rye console under the Account tab. Note this value is unique per environment (staging vs production)
      }
    );
  }
```

**4. Use the access token**

Include the access token within the Authorization header for any requests made to the Rye API.

```typescript TypeScript theme={null}
  const response = await axios.post(
    RYE_API_ENDPOINT,
    GRAPHQL_REQUEST_BODY,
    {
      headers: {
        'Authorization': `Bearer ${JWT_TOKEN}`,
        'Content-Type': 'application/json',
      },
    }
  );
```

> [!NOTE]
>
> When utilizing JWT authentication, there's no need to include the `Rye-Shopper-IP` header in your requests, as Rye will automatically use the client's IP address.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.