resonate-token-authentication-typescript

Resonate Token Authentication & Authorization (TypeScript)

Overview

Resonate supports JWT-based authentication and prefix-based authorization to secure access to the Resonate server and control which promises clients can access. This enables multi-tenant systems, role-based access control, and isolation between different workers or services.

Core principle: Generate JWT tokens signed with a private key, configure the Resonate server with the public key, and clients present tokens to authenticate. Optionally use the prefix claim for fine-grained authorization.

Mental Model

Without Auth:
  Client → Resonate Server → All Promises Accessible

With Token Auth:
  Client + Valid JWT → Resonate Server → All Promises Accessible
  Client + Invalid JWT → Resonate Server → REJECTED (401 Unauthorized)

With Prefix Auth (Multi-Tenant):
  Client + JWT(prefix="tenant-1") → Access only "tenant-1:*" promises
  Client + JWT(prefix="tenant-2") → Access only "tenant-2:*" promises
  Client + JWT(prefix="worker-a") → Access only "worker-a:*" promises

Setup: Generate Keys and Tokens

1. Generate RSA Key Pair

# Generate private key (keep this secret!)
openssl genrsa -out private_key.pem 2048

# Extract public key (share with Resonate server)
openssl rsa -in private_key.pem -pubout -out public_key.pem

Security:

• Store private_key.pem securely (never commit to git, use secrets manager)
• public_key.pem can be deployed with server configuration

2. Install JWT CLI Tool

# macOS
brew install mike-engel/jwt-cli/jwt-cli

# Other platforms
# https://github.com/mike-engel/jwt-cli#installation

3. Generate JWT Tokens

Basic authentication token (no prefix):

jwt encode --secret @private_key.pem -A RS256 '{}'

Token with prefix claim (for authorization):

jwt encode --secret @private_key.pem -A RS256 '{"prefix":"tenant-1"}'

Store token in environment variable:

export MY_TOKEN=$(jwt encode --secret @private_key.pem -A RS256 '{"prefix":"worker-1"}')