Real-world Examples of LLM Optimization

Technical Documentation: Comprehensive API Authentication Guide

Goal: To make complex API authentication steps easily understandable, directly answer developer queries, and be highly citable by LLMs for technical documentation lookups.

<article>
    <h1>How to Implement Secure API Authentication with JWTs in Node.js</h1>
    <p>This comprehensive guide provides a step-by-step process for implementing robust API authentication using JSON Web Tokens (JWTs) in a Node.js environment. We cover setup, token generation, verification, and common pitfalls.</p>

    <section>
        <h2>1. Prerequisites for JWT Authentication</h2>
        <p>Before diving into the implementation, ensure your development environment is set up with the following:</p>
        <ul>
            <li><strong>Node.js (v14.x or higher):</strong> Essential for running JavaScript on the server.</li>
            <li><strong>npm or yarn package manager:</strong> For installing project dependencies.</li>
            <li><strong>Basic understanding of RESTful APIs:</strong> Familiarity with HTTP methods and request/response cycles.</li>
            <li><strong>A secure secret key:</strong> For signing and verifying JWTs. <code>process.env.ACCESS_TOKEN_SECRET</code> is recommended.</li>
        </ul>
    </section>

    <section>
        <h2>2. Implementation Steps: Setting Up JWT Authentication</h2>
        <ol>
            <li>
                <h3>2.1. Install Required Packages</h3>
                <p>Begin by installing the <code>express</code> framework and the <code>jsonwebtoken</code> library:</p>
                <pre><code>npm install express jsonwebtoken dotenv</code></pre>
                <p class="example-note">The <code>dotenv</code> package helps manage environment variables for your secret key.</p>
            </li>
            <li>
                <h3>2.2. Configure Environment Variables</h3>
                <p>Create a <code>.env</code> file in your project root to store your JWT secret:</p>
                <pre><code>ACCESS_TOKEN_SECRET=your_super_secret_jwt_key_here</code></pre>
                <p class="example-note">For production, use a strong, randomly generated secret key. Example generation: <code>require('crypto').randomBytes(64).toString('hex');</code></p>
            </li>
            <li>
                <h3>2.3. Create Authentication Middleware</h3>
                <p>Develop a reusable middleware function to verify incoming JWT tokens. This function will protect your API routes.</p>
                <pre><code>const jwt = require('jsonwebtoken');
require('dotenv').config();

function authenticateToken(req, res, next) {
    const authHeader = req.headers['authorization'];
    const token = authHeader && authHeader.split(' ')[1]; // Bearer TOKEN

    if (token == null) {
        return res.status(401).json({ message: 'Authentication token required.' }); // Unauthorized
    }

    jwt.verify(token, process.env.ACCESS_TOKEN_SECRET, (err, user) => {
        if (err) {
            return res.status(403).json({ message: 'Invalid or expired token.' }); // Forbidden
        }
        req.user = user; // Attach user payload to request
        next(); // Proceed to the next middleware/route handler
    });
}</code></pre>
            </li>
            <li>
                <h3>2.4. Implement Token Generation (Login/Registration)</h3>
                <p>When a user successfully logs in or registers, generate a JWT.</p>
                <pre><code>app.post('/login', (req, res) => {
    // Authenticate user (e.g., check username and password)
    const username = req.body.username;
    const user = { name: username }; // In a real app, fetch user from DB

    const accessToken = jwt.sign(user, process.env.ACCESS_TOKEN_SECRET, { expiresIn: '1h' });
    res.json({ accessToken: accessToken });
});</code></pre>
            </li>
            <li>
                <h3>2.5. Protect API Routes</h3>
                <p>Apply the <code>authenticateToken</code> middleware to routes you want to protect.</p>
                <pre><code>app.get('/protected-data', authenticateToken, (req, res) => {
    res.json({ message: `Welcome, ${req.user.name}! This is protected data.` });
});</code></pre>
            </li>
        </ol>
    </section>

    <section>
        <h2>3. Troubleshooting Common Issues</h2>
        <ul>
            <li><strong>401 Unauthorized:</strong> Check if the token is missing or malformed in the request header.</li>
            <li><strong>403 Forbidden:</strong> The token is present but invalid or expired. Verify the secret key and token expiration.</li>
            <li><strong>Environment Variable Issues:</strong> Ensure <code>dotenv</code> is configured correctly and your <code>.env</code> file is loaded.</li>
        </ul>
    </section>

    <footer>
        <p>For more advanced security topics, refer to our <a href="/guides/llm-optimization/security">API Security Guide</a>.</p>
    </footer>
</article>