Problem
The Mini Apps documentation covers authentication at a high level but does not include a complete end-to-end example of integrating @farcaster/quick-auth for server-side JWT verification.
Developers building mini-apps that need to:
- Authenticate users server-side using their FID
- Protect API routes in Next.js / Hono / Express
- Verify QuickAuth JWTs without a third-party service
...currently have to piece together the flow from the quick-auth README and separate spec pages.
Proposed Addition
Add a dedicated "Authentication" section to the Mini Apps docs with:
- A step-by-step QuickAuth flow diagram
- Client-side code:
const token = await sdk.quickAuth.fetch('/api/protected')
- Server-side JWT verification example:
import { createClient } from '@farcaster/quick-auth';
const client = createClient();
export async function GET(req: Request) {
const token = req.headers.get('Authorization')?.replace('Bearer ', '');
if (!token) return new Response('Unauthorized', { status: 401 });
const payload = await client.verifyJwt({ token, domain: 'yourdomain.com' });
const fid = payload.sub; // verified FID as string
return Response.json({ fid });
}
- Notes on JWT expiry, domain binding, and security considerations
Why This Matters
Authentication is one of the most common needs for mini-app developers building anything beyond read-only UIs. A clear, complete example in the official docs would significantly reduce the barrier to secure mini-app development.
Problem
The Mini Apps documentation covers authentication at a high level but does not include a complete end-to-end example of integrating
@farcaster/quick-authfor server-side JWT verification.Developers building mini-apps that need to:
...currently have to piece together the flow from the
quick-authREADME and separate spec pages.Proposed Addition
Add a dedicated "Authentication" section to the Mini Apps docs with:
const token = await sdk.quickAuth.fetch('/api/protected')Why This Matters
Authentication is one of the most common needs for mini-app developers building anything beyond read-only UIs. A clear, complete example in the official docs would significantly reduce the barrier to secure mini-app development.