JWT templates

A JWT template defines a named set of custom claims to mint into a token — so a downstream service (Hasura, a database RLS policy, your own API) gets exactly the claims it expects. The frontend requests a token for a named template via getToken(template).

{
  "object": "jwt_template",
  "name": "hasura",
  "claims": {
    "https://hasura.io/jwt/claims": "{{org.id}}"
  }
}

Claim values are template strings resolved against the user/session/org at mint time. Reserved claims (sub, iss, aud, exp, iat, …) and private fields are refused — a template can add claims, never forge the ones Atlas controls.

Endpoints

Example

await atlas.jwtTemplates.create({
  name: 'hasura',
  claims: {
    'https://hasura.io/jwt/claims': JSON.stringify({
      'x-hasura-default-role': '{{org.role}}',
      'x-hasura-user-id': '{{user.id}}',
    }),
  },
});

curl https://api.atlas.dev/v1/jwt_templates \
  -H "Authorization: Bearer sk_live_xxx" \
  -H "Content-Type: application/json" \
  -d '{"name":"hasura","claims":{"x-hasura-user-id":"{{user.id}}"}}'

Minting a template token from the frontend

The client mints a short-lived JWT for the active session using a named template:

POST /v1/client/sessions/:id/tokens/:template   (FAPI)

In the SDKs this is getToken({ template: 'hasura' }). The default getToken() (no template) returns the standard session JWT. See Sessions & tokens.