DEV Community: Insaf

Stop using JWT libraries: How to build your own Lightweight Tokens with node:crypto

Insaf — Sun, 01 Feb 2026 09:53:32 +0000

Ever looked at your `node_modules` and wondered why you need a massive library just to sign a small JSON object?

If you are building a Node.js backend, you already have a powerhouse security tool built-in: the node:crypto module.
Today, we’re going to build a custom, secure authentication token system that is faster, leaner, and more secure than standard JWT libraries.

Why skip the library?

Zero Dependencies: No jsonwebtoken means one less package to audit for vulnerabilities.
Performance: node:crypto is a native C++ binding in Node; it’s blazingly fast.
No "Algorithm Switching" Attacks: Most JWT bugs happen because the library allows the client to choose the algorithm (like alg: none). In our code, we hardcode the security.

The Logic

A secure token has two parts:

The Payload: A Base64URL encoded string containing user data (ID, Username, Avatar).
The Signature: An HMAC (Hash-based Message Authentication Code) that proves the payload hasn't been tampered with.

1. The Signing Function

This function takes your user data, adds an expiration timestamp, and signs it using a secret key from your .env.


import { createHmac } from "node:crypto";

const TOKEN_SECRET = process.env.TOKEN_SECRET;

export const signToken = (payload: object) => {
  // Add 15 minute expiration
  const claims = {
    ...payload,
    exp: Date.now() + 15 * 60 * 1000,
  };

  // 1. Encode data to a URL-safe string
  const encodedPayload = Buffer.from(JSON.stringify(claims)).toString("base64url");

  // 2. Create the signature (The "Security Seal")
  const signature = createHmac("sha256", TOKEN_SECRET!)
    .update(encodedPayload)
    .digest("base64url");

  // 3. Combine them with a dot
  return `${encodedPayload}.${signature}`;
};

2. The Verification Function

When the client sends the token back, we need to ensure it's still valid. We use timingSafeEqual to prevent timing attacks, a subtle way hackers guess secrets by measuring how long a string comparison takes.


import { createHmac, timingSafeEqual } from "node:crypto";

export const verifyToken = (token: string) => {
  const [encodedPayload, signature] = token.split(".");
  if (!encodedPayload || !signature) throw new Error("Malformed token");

  // Re-calculate what the signature should be
  const expectedSignature = createHmac("sha256", process.env.TOKEN_SECRET!)
    .update(encodedPayload)
    .digest("base64url");

  // Use timingSafeEqual for high-level security
  const isValid = timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expectedSignature)
  );

  if (!isValid) throw new Error("Invalid signature!");

  const claims = JSON.parse(Buffer.from(encodedPayload, "base64url").toString());

  // Check if expired
  if (Date.now() > claims.exp) throw new Error("Token expired");

  return claims;
};

Pro-Tip: Watch your Header Size!

Since we are putting "heavy" data like avatars and usernames inside the token, the string can get long.

Shorten your keys: Use u for username and img for avatar.

Keep it lean: Only store data the UI needs immediately.

Conclusion

By using node:crypto, you gain total control over your authentication. You aren't just following a tutorial; you're understanding the math and logic that keeps the web secure.

Are you still using JWT libraries, or have you moved to native crypto? Let me know in the comments!

How to Create, Test, and Publish an NPM Package with TypeScript

Insaf — Fri, 21 Nov 2025 16:57:18 +0000

If you are a Node.js developer, you use 3rd-party packages in your day-to-day projects.

But… do you know how to create your own NPM package?

In this article, I’m going to demonstrate how to:

create
test
publish

your own NPM package: string-manipulate

🚀 1. Create a New NPM Project

mkdir string-manipulate
cd string-manipulate
npm init -y

This generates a basic package.json file

📦 2. Add TypeScript to the Project

Install TypeScript and types for Node:

npm install typescript --save-dev
npm install @types/node --save-dev

Initialize TypeScript:

npx tsc --init

Update tsconfig.json to ensure proper module resolution for publishing:

{
  "compilerOptions": {
    "target": "ES2017",
    "module": "CommonJS",
    "declaration": true,
    "outDir": "./dist",
    "strict": true
  },
  "include": ["src"]
}

📁 3. Add Your Source Code

Create the folder structure:

mkdir src

Create your main file: src/index.ts

export function reverse(str: string): string {
  return str.split("").reverse().join("");
}

export function capitalize(str: string): string {
  if (!str) return "";
  return str[0].toUpperCase() + str.slice(1);
}

🧪 4. Add Tests (Optional but Recommended)

Let's use Jest.
Install Jest with TypeScript support:

npm install --save-dev jest ts-jest @types/jest

Initialize Jest config:

npx ts-jest config:init

Create a test: tests/index.test.ts

import { reverse, capitalize } from "../src";

test("reverse string", () => {
  expect(reverse("hello")).toBe("olleh");
});

test("capitalize string", () => {
  expect(capitalize("hello")).toBe("Hello");
});

Run tests:

npm test

🛠 5. Build the Project

Add this script to package.json:

"scripts": {
  "build": "tsc",
  "test": "jest"
}

Now run:

npm run build

This generates compiled files in dist/

📤 6. Prepare for Publishing

Update your package.json:

{
  "name": "string-manipulate",
  "version": "1.0.0",
  "main": "dist/index.js",
  "types": "dist/index.d.ts",
  "files": [
    "dist"
  ],
  "scripts": {
    "build": "tsc",
    "test": "jest"
  }
}

The "types" field allows TypeScript users to automatically get typings.

7. Use your package locally before publishing

run:

npm link

This makes your package available globally as a symlink.
Now, you can install it in your local machine:

npm link string-manipulate

🔄 When you make changes
You only need to run:

npm run build

in your package
The link updates automatically.

🔑 8. Login to NPM

npm login

Follow the prompts.

📦 9. Publish the Package

Before publishing, build again:

npm run build

publish:

npm publish

🎉 Congratulations — your TypeScript-ready NPM package is live!

🎯 10. Using the Package

Anyone can now install it via:

npm install string-manipulate

Example usage:

import { reverse, capitalize } from "string-manipulate";

console.log(reverse("hello")); // olleh
console.log(capitalize("hello")); // Hello

📚 Final Thoughts

Publishing your own package is a great way to share utilities across projects — or even with the world. With TypeScript support built in, your users get type safety and better DX out of the box.

If you'd like, I can also help you:

✅ add GitHub Actions for auto-publishing
✅ configure semantic-release
✅ create a README template

Just ask!

SmartPair - An Agent first freelancing platform.

Insaf — Mon, 10 Nov 2025 07:01:32 +0000

This is a submission for the Agentic Postgres Challenge with Tiger Data

Problem that I discovered

Freelancers often struggle to find jobs that truly match their skills, while clients spend too much time sorting through proposals that don’t fit their project needs. Traditional freelancing platforms rely on keyword matching, which often misses the context or intent behind a job or service.

The solution for it

A smarter freelancing platform that automatically matches freelancers’ services with client job postings using Agentic Postgres. The system analyzes job descriptions and service listings semantically, understanding what the client needs and which freelancers can deliver the best results.

What I Built

My application is a modern freelancing marketplace with two main roles:

Freelancers: Create detailed service listings describing their skills, pricing, and deliverables.
Clients: Post jobs with requirements and budgets.

Agentic Postgres powers the intelligent recommendation layer that suggests the most relevant freelancers to each job — helping clients find ideal candidates faster and improving visibility for freelancers.

Inspiration:

I’ve often seen clients overwhelmed with irrelevant bids and freelancers missing good opportunities. I wanted to create a fair, intelligent matching system that benefits both sides.

How I Used Agentic Postgres

I leveraged several Agentic Postgres features to build a powerful and intelligent recommendation system:

🧠 pg_text search: Used for semantic matching between job descriptions and freelancer service listings. This allows the system to recommend services that mean the same thing, not just share the same keywords.
⚡ Fast Forks: Enabled isolated testing and prototyping of different matching algorithms without duplicating data manually.
🔍 Tiger CLI: Simplified schema management and quick querying during development.
💾 Fluid Storage: Used to manage vector embeddings for freelancer service descriptions and job texts, improving search and recommendation speed.

Below is a simplified version of how I implemented semantic matching between jobs and freelancer services using Agentic Postgres:

-- Enable the Agentic Postgres extensions
CREATE EXTENSION IF NOT EXISTS pg_text;
CREATE EXTENSION IF NOT EXISTS vector;
CREATE EXTENSION IF NOT EXISTS tiger;

-- 1️⃣ Create tables for freelancers and jobs
CREATE TABLE freelancers (
    id SERIAL PRIMARY KEY,
    name TEXT NOT NULL,
    service_title TEXT,
    service_description TEXT,
    service_embedding vector(768)  -- store embedding for semantic search
);

CREATE TABLE jobs (
    id SERIAL PRIMARY KEY,
    client_name TEXT NOT NULL,
    job_title TEXT,
    job_description TEXT,
    job_embedding vector(768)  -- embedding for matching
);

-- 2️⃣ Generate embeddings using pg_text (powered by built-in LLM models)
-- These embeddings capture the semantic meaning of text
UPDATE freelancers
SET service_embedding = pg_text.embed(service_description);

UPDATE jobs
SET job_embedding = pg_text.embed(job_description);

-- 3️⃣ Create an index for fast vector search (Fluid Storage optimization)
CREATE INDEX ON freelancers USING ivfflat (service_embedding vector_cosine_ops);

-- 4️⃣ Recommend freelancers for a given job
-- This query finds the top 5 freelancers whose services semantically match the job
SELECT 
    f.id,
    f.name,
    f.service_title,
    1 - (f.service_embedding <=> j.job_embedding) AS similarity_score
FROM 
    freelancers f, jobs j
WHERE 
    j.id = 1  -- target job
ORDER BY 
    f.service_embedding <=> j.job_embedding  -- cosine distance
LIMIT 5;

-- 5️⃣ (Optional) Store accepted matches for analytics
CREATE TABLE job_matches (
    job_id INT REFERENCES jobs(id),
    freelancer_id INT REFERENCES freelancers(id),
    match_score FLOAT
);

INSERT INTO job_matches (job_id, freelancer_id, match_score)
SELECT j.id, f.id, 1 - (f.service_embedding <=> j.job_embedding)
FROM freelancers f, jobs j
WHERE j.id = 1
ORDER BY f.service_embedding <=> j.job_embedding
LIMIT 1;

🔍 Explanation of What’s Happening

pg_text.embed() automatically converts text (like job descriptions) into embeddings using built-in models.
vector(768) stores the embedding efficiently in Postgres.
ivfflat index (with vector_cosine_ops) makes vector similarity search super fast.
The query ranks freelancers by semantic similarity, not just keywords — so “web app developer” matches “React frontend engineer,” even if the words differ.
Finally, the match results can be inserted into a job_matches table to record accepted pairings.

This combination allowed me to build a fast, agentic recommendation engine directly inside Postgres — no external vector database required.

Overall Experience

Building with Agentic Postgres was a smooth and surprisingly fun experience. I was impressed by how seamlessly I could integrate AI-powered text search and recommendation logic directly into the database.

What worked well:

Semantic matching was fast and accurate.
The Tiger CLI made experimentation effortless.
Easy to scale and test different models using fast forks.

Challenges:

Fine-tuning embeddings for different categories of jobs required experimentation.
Understanding how to optimize queries for vector search took some learning.

Learnings:

Agentic Postgres makes it possible to bring intelligence closer to the data layer, reducing the need for complex backend logic. It’s perfect for building AI-driven, real-time recommendation systems like this freelancing platform.

Task0 - AI task manager

Insaf — Mon, 27 Oct 2025 06:23:54 +0000

This is a submission for the Auth0 for AI Agents Challenge

What I Built

I built an AI task manager application. Task0 can handle google task seamlessly.

Demo

Live App: Task0
Repository:

itsmefminsaf / task0

How I Used Auth0 for AI Agents

Authentication and Authorization: With Auth0 I could handle all the user authentication and session management more efficiently.
Token Vault: By using Auth0 token vault I could give access to APIs and resources to AI more securely.

Lessons Learned and Takeaways

By building this project I have learnt the impotence of securing AI agents while building AI powered application. With Auth0 it will be a peace of cake. Auth0 manages external token, use session and role based authentication as a pro.

Agent Snape - your GitHub manager

Insaf — Sun, 26 Oct 2025 04:56:28 +0000

This is a submission for the Auth0 for AI Agents Challenge

What I Built

I build an AI agent named Snape that can supervise your GitHub account seamlessly.

Just enter List my repositories and the Snape will summarize your all GitHub repositories

Demo

Live demo: Agent Snape
Repository:

itsmefminsaf / snape

This is a submission for the Auth0 for AI Agents Challenge

What I Built

I build an AI agent named Snape that can supervise your GitHub account seamlessly.

Just enter List my repositories and the Snape will summarize your all GitHub repositories

Demo

Live demo: Agent Snape

Here's some screenshots:

How I Used Auth0 for AI Agents

Authentication and session management: I used Auth0's login and logout functionalities to manage users identification. And also getSession function and useUser hook for session management.
Secure AI on user's behalf: I used Auth0's token vault to get users GitHub token

const github = new Octokit({ auth: token });

const { data } = await github.request("GET /user/repos", {
  visibility: "all",
});

Snape has a check-point protected by auth0. It can't do anything without Auth0 permission given by…

View on GitHub

Here's some screenshots:

How I Used Auth0 for AI Agents

Authentication and session management: I used Auth0's login and logout functionalities to manage users identification. And also getSession function and useUser hook for session management.
Secure AI on user's behalf: I used Auth0's token vault to get users GitHub token

const github = new Octokit({ auth: token });

const { data } = await github.request("GET /user/repos", {
  visibility: "all",
});

Snape has a check-point protected by auth0. It can't do anything without Auth0 permission given by Auth0 token vault.

Lessons Learned and Takeaways

By doing this project I have learn the importance of securing AI agent and how Auth0's features simplify the overall process.

Takeaways

Manage which APIs the agent can use on the user's behalf.
Limit agent's knowledge.

Tech stack I used during the project

Next.js 15
Vercels AI-SDK
Auth0 for AI agents
HuggingFace free inference provider
Github's Octokit SDK

DEV Community: Insaf

Stop using JWT libraries: How to build your own Lightweight Tokens with node:crypto

Ever looked at your node_modules and wondered why you need a massive library just to sign a small JSON object?

Why skip the library?

The Logic

1. The Signing Function

2. The Verification Function

Pro-Tip: Watch your Header Size!

Conclusion

How to Create, Test, and Publish an NPM Package with TypeScript

🚀 1. Create a New NPM Project

📦 2. Add TypeScript to the Project

📁 3. Add Your Source Code

🧪 4. Add Tests (Optional but Recommended)

🛠 5. Build the Project

📤 6. Prepare for Publishing

7. Use your package locally before publishing

🔑 8. Login to NPM

📦 9. Publish the Package

🎯 10. Using the Package

📚 Final Thoughts

SmartPair - An Agent first freelancing platform.

Problem that I discovered

The solution for it

What I Built

Inspiration:

How I Used Agentic Postgres

Overall Experience

Challenges:

Learnings:

Task0 - AI task manager

What I Built

Demo

itsmefminsaf / task0

How I Used Auth0 for AI Agents

Lessons Learned and Takeaways

Agent Snape - your GitHub manager

What I Built

Demo

itsmefminsaf / snape

What I Built

Demo

Here's some screenshots:

How I Used Auth0 for AI Agents

Here's some screenshots:

How I Used Auth0 for AI Agents

Lessons Learned and Takeaways

Takeaways

Tech stack I used during the project

Ever looked at your `node_modules` and wondered why you need a massive library just to sign a small JSON object?