NestJS Authentication

Token verification, guarded routes, roles, and API tokens for your NestJS API. Paste one prompt into your AI agent, or wire it yourself with one module import.

Quickstart in minutes

Enterprise-grade & compliant by default

Add auth to my NestJS API using The Bridge.

Your NestJS API, wired in

One module importBridgeModule.forRoot({ appId }) wires verification into your app.
Routes guarded by defaultThe global BridgeAuthGuard protects everything; @Public() marks the exceptions.
The user by decorator@CurrentUser() hands any controller the verified user.
Machines welcome tooScripted callers authenticate with revocable API tokens.

The fastest way to integrate

Auth by asking.

The Bridge is agent-native. Install the Bridge CLI, paste one prompt, and your coding agent wires authentication into your NestJS API.

✦ CLI-nativeClaude CodeCursorAny coding agent

Your agent does the wiring, you ship the product

Install the Bridge CLI, then paste the prompt below into your agent. It authorizes the CLI in your browser (creating your account right there if you are new), detects NestJS, installs the SDK, wires the module, and registers the settings your API needs.

Prefer to wire it yourself? See the SDK and CLI paths below.

Why The Bridge for NestJS

Everything after login, already there

Verifying a token is the visible part. The wins are everything you no longer have to build around it.

Routes guarded by default

Protect everything globally or mark individual endpoints; public routes are the ones you declare.
Security
Every sign-in method

Email, passkeys, magic link, and Google, hosted or in your own UI, toggled with no redeploy.
UX
Authorization built in

Roles ride the verified token, so a controller can require one with a single decorator.
RBAC
Enterprise SSO ready

When the security questionnaire arrives, connect their identity provider and keep your architecture.
Enterprise
Built for teams

Multi-tenant user management out of the box: workspaces, invites, and roles included.
B2B
Session management

Sessions issued, renewed, and revoked centrally. Block a user and they are out on the next request.
Control
MFA included

Multi-factor authentication ships with the platform, no extra vendor to integrate.
Trust
API tokens for machines

External services and scripted callers authenticate with API tokens you can revoke at any time.
M2M

Prefer to wire it yourself?

Pick the workflow that matches how you build.

SDK

// app.module.ts
import { BridgeModule } from '@nebulr-group/bridge-nestjs';

@Module({
  imports: [
    BridgeModule.forRoot({ appId: BRIDGE_APP_ID }),
  ],
})
export class AppModule {}

// in any controller:
findAll(@CurrentUser() user: BridgeUser) { ... }

Read the full quickstart in the docs →

And of course

First-class SDKs for every stack

Type-safe, batteries-included SDKs with drop-in components, and the same clean user object everywhere.

Next.js

Svelte

Astro

Node

FastAPI

Laravel

Flutter

React

Angular

Nuxt

Deno

Python

Rust

Ruby

Kotlin

Vue

SolidJS

Remix

Bun

Django

PHP

.NET

NestJS

…and 24+ frameworks & languages supported. Hover to pause, drag or swipe to explore.

Check out our NestJS SDK on GitHub

Hand-Rolled NestJS Authentication vs. The Bridge

What a hand-built NestJS auth stack actually costs you, versus one module import.

Building it yourself

Wire Passport strategies, an auth module, and a JWT guard yourself
Stand up login, session, refresh, and logout endpoints
Manage signing keys, rotation, and token revocation
Add SSO, more sign-in methods, and user management when customers ask

With The Bridge

One module import, routes guarded by default
Login hosted for you or dropped into your UI, nothing to stand up
Tokens verified against published keys, revocation included
SSO and multi-tenant user management on the same user object

Common questions

How do I protect routes with a NestJS guard?

The Bridge handles the guard for you: protect every route globally with one setting, or mark individual endpoints, and the few that stay public, right on the controller. New routes are born protected, so nobody can forget to guard one. The route guards docs show the exact setup.

Do I need Passport strategies?

No. The guard verifies signed session tokens against published public keys directly, so there are no strategies to pick, configure, or keep updated. Your controllers just receive the verified user.

Does this use JWT authentication?

Yes. The guard verifies standard signed JSON Web Tokens from the Authorization header against The Bridge's published public keys. To see what lives inside a token and how verification works, read JWT authentication explained.

How do I get the current user in a controller?

Straight from the method signature: the SDK hands any controller the verified user, and the workspace it belongs to, already typed. No request-object digging. The user token docs show the exact code.

How do I check roles in NestJS?

With one annotation on a controller or route: require a role and the handler only runs for callers that have it. Roles are configured in the Control Center and arrive as claims on the verified token, so the API and the frontend authorize from the same source. The roles docs cover the setup end to end.

Where does login happen if NestJS only verifies tokens?

In your frontend, in the flavor you choose: use The Bridge's hosted login page, or build the login into your own UI with the frontend SDK components (React, Angular, Next.js, and Svelte). Either way The Bridge issues the session, the client sends the signed token with each request, and your NestJS API stays a clean verifier: no login, refresh, or logout endpoints to build.

How do machines and scripts authenticate?

With API tokens. A scripted caller sends its token in a request header, the guard verifies it, and you can scope what each token may do. Tokens are revocable at any time from the Control Center. The API token docs show the setup.

Which NestJS versions does the SDK support?

The published @nebulr-group/bridge-nestjs 0.4.x line supports NestJS 10 and 11. Check the NestJS quickstart for the currently supported range before adding it to a newer project.