End-user database access
Expose user-specific rows through the Data API.
Neon · Const
JWT authorize
Neon authorizes end users through the Data API with JWTs. The token determines the PostgreSQL role used for the query, while GRANT permissions and Row-Level Security control access.
How it works
Neon authorizes end users through the Data API with a JWT from a trusted issuer. The API validates the token, chooses a PostgreSQL role from it, and executes the query under that role, where GRANT permissions and Row-Level Security determine access.
Syntax
Authorization: Bearer <your_jwt_token>Parameters
| Name | Type | Description |
|---|---|---|
Authorization header | Bearer JWT | JWT supplied in the HTTP Authorization: Bearer <token> header. |
Returns
A Data API query result authorized and executed under the PostgreSQL role selected from the JWT.
Key points
- The JWT is the credential Neon uses to authorize an end user through the Data API.
- Only tokens issued by a provider trusted by the project are eligible for authorization.
- Neon maps the incoming token to a PostgreSQL role before running the query.
- The database executes the request under the selected role rather than an unrestricted administrator identity.
- The selected role's privileges and Row-Level Security policies determine the operations and rows the request can access.
Example: Read the authenticated user ID
const { data } = await sql`select auth.user_id();`;Run a Data API query after Neon has authorized the request's JWT and made its identity available to PostgreSQL.
When to use it
RLS-protected queries
Apply PostgreSQL Row-Level Security based on the authenticated identity.
Third-party authentication
Use an external identity provider with Neon.
Interview questions
QHow does Neon use a JWT to authorize a Data API request?
Neon uses a JWT to authorize end users through the Data API. The API selects a PostgreSQL role from the token, then PostgreSQL permissions and RLS policies control the query.
Follow-up: What role is used for a valid ordinary user token? The API switches to the authenticated role unless a custom role is selected from the JWT role claim.
QWhich JWT claim is important for RLS policies?
The JWT identifies the user through its sub claim. RLS policies can use that identity to restrict rows, so the claim must be present when policies depend on it.
Follow-up: What happens without a valid signed-in user token? The request is treated as anonymous and uses the anonymous role, unless the configured authorization setup provides another role.
QHow should a client send the JWT to Neon?
The request carries the token in the HTTP Authorization header using the Bearer scheme. Neon validates the token from a trusted issuer before selecting the database role.
Follow-up: How can an application support a provider other than Neon Auth? Configure that provider's JWKS URL so the Data API can validate its JWTs.
Related
Data APINeon AuthRow-Level Security (RLS)authenticated roleanonymous roleauth.user_id()