fastify-xauth-local

local.me

Built-in GET route that returns the current authenticated user's profile from the JWT or database.

local.me

Built-in GET {loginPath}/me route registered when local.enabled is true. Returns the current user's profile. If skipUserLookup is false (default), it calls userLookup for fresh data from your database. If skipUserLookup is true, it returns the decoded token claims directly.

Default path: {prefix}/local/me (e.g. /api/local/me)

Signature

GET {loginPath}/me
Authorization: Bearer <token>

Returns

200 OK:

{
  "id": 1,
  "email": "user@example.com",
  "first_name": "Jane",
  "last_name": "Doe",
  "admin": false,
  "color": "#abc",
  "scope": ["user"]
}

Throws

Status	Message	Reason
401	Authentication required	No valid JWT in request

This route requires authentication. The auth middleware runs before this handler.

Examples

Basic: fetch current user

curl http://localhost:3000/api/local/me \
  -H "Authorization: Bearer <token>"

const user = await fetch("/api/local/me", {
  headers: { Authorization: `Bearer ${token}` },
}).then((r) => r.json());

console.log(user.email); // "user@example.com"

Advanced: skipUserLookup vs. database refresh

// skipUserLookup: true — returns token claims (faster, stale if user was updated)
{
  local: {
    enabled: true,
    skipUserLookup: true,
    userLookup: async (email) => db.users.findByEmail(email), // still used for login
  }
}

// skipUserLookup: false (default) — calls userLookup for every /me request
// Falls back to token data if userLookup throws or returns null
{
  local: {
    enabled: true,
    skipUserLookup: false,
    userLookup: async (email) => db.users.findByEmail(email),
  }
}

AI Context

package: "@xenterprises/fastify-xauth-local"
route: GET {loginPath}/me (default /api/local/me)
use-when: Built-in current-user route — returns user data from the JWT or from userLookup
requires: local.enabled: true; requires valid JWT in Authorization header
returns: user object (from userLookup) or token payload (when skipUserLookup: true)

Edit this pageorReport an issue

local.login

Built-in POST route that authenticates a user with email and password and returns a signed JWT.

local.password-reset

Built-in POST/PUT routes for requesting and completing a password reset flow.