Neon Authorize Demo with Custom JWTs

This is a project that showcases how to use Neon Authorize with custom JWTs. Instead of relying on JWTs that are generated by an authentication provider (Clerk, Auth0, etc.), this project uses a custom JWT that is signed by the server.

This is a HONC API which exposes a few endpoints:

• /api/token — returns a custom JWT that is signed by the server
• /.well-known/jwks.json — returns the public key that can be used to verify the signature of the custom JWT (this is used by Neon Authorize to verify the signature of the custom JWT)
• /api/users — returns a list of users
• /api/tenants — returns a list of tenants

The schema is generated by Drizzle and can be found in src/db/schema.ts. The generated SQL is in the drizzle/ directory. There's also a seed.sql file that can be used to seed the database with some data, that is specific to this demo.

Steps to run the project

1. Generate the keys that will be used to sign the JWT. You can run bun generate-keys.ts and you will get a publicKey.jwk.json and a privateKey.jwk.json file.
2. Create a Neon project
3. Set up a wrangler.toml file with the following configuration:

name = "my-honc-service"
compatibility_date = "2024-07-25"
compatibility_flags = [ "nodejs_compat" ]

[vars]
# neondb_owner role
OWNER_DATABASE_URL = ""
# authenticated, passwordless role (you can keep this empty for now)
DATABASE_URL = ""
# contents of publicKey.jwk.json
PUBLIC_KEY=''
# contents of privateKey.jwk.json
PRIVATE_KEY=''

3. Deploy this demo with bun run deploy.
4. Go to https://my-honc-service.<your-name>.workers.dev/.well-known/jwks.json to verify the public key is being served appropriately.
5. Go to the Authorize page in the Neon console and add an auth provider (type should be "Other"), and set the JWKS URL to the URL from the previous step.
6. Follow the steps in the UI to setup the roles for Neon Authorize. You should ignore the schema related steps if you're following this guide
7. Apply migrations with bun run db:migrate (you'll have to populate .dev.vars with the database URLs from the Neon console). Notice that there's 2 different database URLs that are expected in the .dev.vars file. The first one is for the neondb_owner role, and the second one is for the authenticated, passwordless role.
8. Seed the database with bun run db:seed.
9. Grab the authenticated role's database URL from the Neon console and set it in the .dev.vars file, as well as in the wrangler.toml file.
10. Deploy this demo again with bun run deploy.
11. Head to https://my-honc-service.<your-name>.workers.dev/api/users and https://my-honc-service.<your-name>.workers.dev/api/tenants to verify that the API is working as intended.