OverviewHistoryStatsSecurity
npx skills add ...
Documentation
SKILL.md
npx skills add auth0/agent-skills --skill auth0-fastify
Use when adding session-based login, logout, or protected routes to a Fastify web application. Integrates @auth0/auth0-fastify — use even if the user says "add login to my Fastify app". For Fastify APIs validating Bearer tokens, use auth0-fastify-api instead.
npx skills add auth0/agent-skills --skill auth0-fastify
Add authentication to Fastify web applications using @auth0/auth0-fastify.
auth0-quickstart skill firstauth0-react, auth0-vue, or auth0-angular for client-side authauth0-nextjs skill which handles both client and serverauth0-react-native for React Native/Expo@auth0/auth0-fastify-api instead for JWT validation without sessionsCreate .env:
Generate secret: openssl rand -hex 64
Create your Fastify server (server.js):
This automatically creates:
/auth/login - Login endpoint/auth/logout - Logout endpoint/auth/callback - OAuth callbackStart your server:
Visit http://localhost:3000 and test the login flow.
| Mistake | Fix |
|---|---|
| Forgot to add callback URL in Auth0 Dashboard | Add /auth/callback path to Allowed Callback URLs (e.g., http://localhost:3000/auth/callback) |
| Missing or weak SESSION_SECRET | Generate secure 64-char secret with openssl rand -hex 64 and store in .env |
| App created as SPA type in Auth0 | Must be Regular Web Application type for server-side auth |
| Session secret exposed in code | Always use environment variables, never hardcode secrets |
| Wrong appBaseUrl for production | Update APP_BASE_URL to match your production domain |
| Not awaiting fastify.register | Fastify v4+ requires awaiting plugin registration |
auth0-quickstart - Basic Auth0 setupauth0-migration - Migrate from another auth providerauth0-mfa - Add Multi-Factor Authenticationauth0-cli - Manage Auth0 resources from the terminalPlugin Options:
domain - Auth0 tenant domain (required)clientId - Auth0 client ID (required)clientSecret - Auth0 client secret (required)appBaseUrl - Application URL (required)sessionSecret - Session encryption secret (required, min 64 chars)audience - API audience (optional, for calling APIs)Client Methods:
fastify.auth0Client.getSession({ request, reply }) - Get user sessionfastify.auth0Client.getUser({ request, reply }) - Get user profilefastify.auth0Client.getAccessToken({ request, reply }) - Get access tokenfastify.auth0Client.logout(options, { request, reply }) - Logout userCommon Use Cases:
preHandler to check session (see Step 4)!!sessiongetUser({ request, reply })getAccessToken({ request, reply })import 'dotenv/config';
import Fastify from 'fastify';
import fastifyAuth0 from '@auth0/auth0-fastify';
import fastifyView from '@fastify/view';
import ejs from 'ejs';
const fastify = Fastify({ logger: true });
// Register view engine
await fastify.register(fastifyView, {
engine: { ejs },
root: './views',
});
// Configure Auth0 plugin
await fastify.register(fastifyAuth0, {
domain: process.env.AUTH0_DOMAIN,
clientId: process.env.AUTH0_CLIENT_ID,
clientSecret: process.env.AUTH0_CLIENT_SECRET,
appBaseUrl: process.env.APP_BASE_URL,
sessionSecret: process.env.SESSION_SECRET,
});
fastify.listen({ port: 3000 });// Public route
fastify.get('/', async (request, reply) => {
const session = await fastify.auth0Client.getSession({ request, reply });
return reply.view('views/home.ejs', {
isAuthenticated: !!session,
});
});
// Protected route
fastify.get('/profile', {
preHandler: async (request, reply) => {
const session = await fastify.auth0Client.getSession({ request, reply });
if (!session) {
return reply.redirect('/auth/login');
}
}
}, async (request, reply) => {
const user = await fastify.auth0Client.getUser({ request, reply });
return reply.view('views/profile.ejs', { user });
});node server.js