Grantex for Express.js — AI Agent JWT Authorization

The Problem

Without Grantex

Your Express APIs accept API keys or bearer tokens with no scope enforcement. Any valid token can access any endpoint. No agent identity tracking.

With Grantex

Grantex middleware verifies JWTs against published JWKS, enforces scopes per route, and identifies the calling agent. Warm resolvers can reuse cached signing keys; initial retrieval and rotation refreshes require network access.

How Grantex Works with Express.js

Install the middleware

npm install @grantex/express — uses Express and @grantex/sdk as peer dependencies.

Add to your app

One line to protect your routes. Specify required scopes per endpoint.

Local verification

JWT signatures are checked locally. Warm resolvers can reuse cached JWKS keys; initial retrieval and rotation refreshes require network access.

Access agent identity

req.grant contains the verified agent DID, scopes, principal, and grant ID.

Service middleware

JWKS-backed verification, scope enforcement, key rotation support, and typed authorization errors.

Quick Start

npm install @grantex/express

import express from 'express';
import {
  requireGrantToken,
  requireScopes,
  type GrantexRequest,
} from '@grantex/express';

const app = express();

app.use('/api', requireGrantToken({
  jwksUri: 'https://api.grantex.dev/.well-known/jwks.json',
}));

app.get('/api/emails', requireScopes('email:read'), (req, res) => {
  const grant = (req as GrantexRequest).grant;
  console.log(grant.agentDid);
  console.log(grant.scopes);
  res.json({ emails: [] });
});

Why Grantex for Express.js

Express Middleware

Install the middleware on every protected Express route and verify compatibility with your Express version.

JWKS Verification

Signing keys are retrieved from the configured JWKS endpoint. Cached resolvers avoid repeat fetches while valid and refresh as keys rotate.

Per-Route Scopes

requireScopes() enforces specific permissions per endpoint. Returns 403 if scopes don't match.

Agent Identity

req.grant provides agent DID, scopes, principal ID, and grant ID after verification.

JWKS Caching

Automatic key caching and rotation. Handles key rollover transparently.

TypeScript Support

Full type definitions are provided for req.grant and verified grant claims.

Verification, revocation, and audit boundary

This integration enforces authorization only where its wrapper or middleware is installed. Local JWT verification checks signatures and claims after JWKS retrieval; it does not prove current revocation unless the verifier performs an online state check or synchronizes revocation data.

Token verification does not create a consent record or prove that a tool executed. Use the configured authorization flow for grant decisions and add an audit integration at the execution boundary when action records are required.

Ready to secure your Express.js agents?

Follow the integration guide and verify the package version before deployment. Apache 2.0.

Sign Up Free Read the Docs

Grantex Middleware for Express.js