Skip to main content
1

Send

The client is the same everywhere — it is fetch and a key, with no Node-only dependency in the call path.
2

Protect routes

lathExpress verifies the bearer token and puts the user on req.lath. A request without a valid one is answered 401 with www-authenticate: Bearer and the usual { error: { code, message, fix } } body — the middleware never hands a half-authenticated request to your handler.
3

Without a framework

userFromNodeRequest takes a raw Node request and returns the user or null, which is everything Fastify, Koa or node:http needs.
Last modified on September 13, 2026