How do you implement multi-tenant authentication where each tenant has its own JWT secret in NestJS?

Q: How do you implement multi-tenant authentication where each tenant has its own JWT secret in NestJS?

@Injectable() export class MultiTenantJwtStrategy extends PassportStrategy(Strategy, 'jwt-mt') { constructor( private tenantsService: TenantsService, private usersService: UsersService, ) { super({ jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken(), secretOrKeyProvider: async ( req: Request, rawJwtToken: string, done: Function, ) => { try { // Decode without verifying to get tenantId from payload const decoded = jwt.decode(rawJwtToken) as { tenantId: string }; if (!decoded?.tenantId) return done(new UnauthorizedException()); const tenant = await tenantsService.findById(decoded.tenantId); if (!tenant) return done(new UnauthorizedException('Unknown tenant')); done(null, tenant.jwtSecret); // secret used for signature verification } catch (e) { done(e); } }, }); } async validate(payload: MultiTenantJwtPayload): Promise { const user = await this.usersService.findInTenant(payload.sub, payload.tenantId); if (!user) throw new UnauthorizedException(); return { ...user, tenantId: payload.tenantId }; } } Decoding without verifying to read tenantId is safe — the payload is only used to look up the verification secret. The signature is verified by Passport after secretOrKeyProvider returns the correct secret. validate() confirms the user belongs to the tenant in the token — prevents cross-tenant token reuse. Use a different signing key per tenant — a compromised tenant's secret does not affect other tenants. Cache tenant secrets with a short TTL to avoid a database lookup on every request.

Difficulty: 7/10

JWT, multi-tenant authentication, NestJS guards

Use the secretOrKeyProvider option in PassportStrategy to perform a dynamic secret lookup. Decode the token without verifying it to extract the tenantId, look up the tenant's secret, and return it to Passport for signature verification. This is safe because the secret is used for verification, not trust.

Multi-tenant JWT strategy with dynamic secret provider

Multi-tenant JWT security notes:

1
Decoding without verifying to read tenantId is safe — the payload is only used to look up the verification secret.
2

How do you implement multi-tenant authentication where each tenant has its own JWT secret in NestJS?

Difficulty: 7/10

JWT, multi-tenant authentication, NestJS guards

Use the secretOrKeyProvider option in PassportStrategy to perform a dynamic secret lookup. Decode the token without verifying it to extract the tenantId, look up the tenant's secret, and return it to Passport for signature verification. This is safe because the secret is used for verification, not trust.

Multi-tenant JWT strategy with dynamic secret provider

Multi-tenant JWT security notes:

1
Decoding without verifying to read tenantId is safe — the payload is only used to look up the verification secret.
2

How do you implement multi-tenant authentication where each tenant has its own JWT secret in NestJS?

How do you implement multi-tenant authentication where each tenant has its own JWT secret in NestJS?

Scenario Questions

Follow-up Questions