how to fetch JWT_SECRET=a_long_random_secret_here

JWT.io
1

how to fetch JWT_SECRET=a_long_random_secret_here

2

Hi @himakshimanmode24

Welcome to the Auth0 Community!

Could you please provide more details regarding your question?

Thanks!
Dawid

3

Hi everyone,

We are looking to optimize and provide additional information to Community Topics that others might find useful, or where a common issue is presented.

I understand you are looking to acquire or fetch a JWT_SECRETin the context of Auth0 to configure your backend or application environment (such as JWT_SECRET=a_long_random_secret_here). The correct approach depends on whether you are verifying tokens signed by Auth0, or signing your own internal tokens.

Recommended solutions

Below is a breakdown of how to obtain the appropriate secret or key based on your architecture :

Scenario A: You want to verify JWTs issued by Auth0 (Recommended: RS256)

If Auth0 is acting as your Identity Provider (IdP) and issuing tokens, you should not use a symmetric shared secret (JWT_SECRET) . Modern applications use asymmetric signing (RS256) .

In this flow:

  • Auth0 signs the token using its Private Key (which it never shares) .

  • Your Backend verifies the token using Auth0’s Public Key.

To fetch the public keys dynamically, your backend should query your tenant’s public JWKS (JSON Web Key Set) endpoint :

https://{your_auth0_domain}/.well-known/jwks.json

Libraries like jwks-rsa or express-jwt can be configured to fetch and cache these keys automatically, eliminating the need to hardcode any JWT_SECRET .

Scenario B: You are using Symmetric Signing (HS256) in Auth0

If you have explicitly configured your Auth0 API or Application to use HS256 (symmetric cryptography), the token is signed and verified using the same secret key . In Auth0, this shared secret is your Application’s Client Secret .

To fetch it:

  1. Log in to your Auth0 Dashboard;

  2. Navigate to Applications > Applications and select your application;

  3. Under the Settings tab, locate the Client Secret field;

  4. Copy this value and set it as your environment variable:

    JWT_SECRET=your_auth0_client_secret_here

Note: If you are verifying tokens for an API, go to Applications > APIs, select your custom API, and retrieve the Signing Secret under its settings tab.

Scenario C: You are signing your own internal session/app tokens (e.g., NextAuth, Buggregator, Retool)

If your framework or tool (like Retool or NextAuth) uses Auth0 for login but handles its own session management, it often requires a local JWT_SECRET to sign its own internal session JWTs. This secret is not generated by Auth0. You must generate a secure, cryptographically strong random string yourself and provide it to your environment variables:

Run one of the following commands in your terminal to generate a secure secret:

  • Using OpenSSL (Standard):

    openssl rand -hex 32

  • Using Node.js:

    node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"

Copy the generated output and assign it to your environment variable:

JWT_SECRET=6a4f91b7d5e... (your generated hex string)

Common Pitfalls & Security Best Practices

  • Don’t share or commit your secret: Never commit your JWT_SECRET or Client Secret to version control (like GitHub) . Always load them securely using environment variables (.env files or system environment setups) .

  • Prefer RS256: It is highly recommended to migrate your Auth0 settings to use RS256 instead of HS256 . Since RS256 relies on public keys for verification, your backend is at no risk of leaking a signing secret if its environment is compromised .

We hope this provided some useful information to help you achieve your desired outcome!

Have a great one,
Gerald