# Web App Middleware Developer Guides

Drop-in middleware for verifying Twingate Identity Firewall JWTs in your web app.

These guides provide drop-in middleware for verifying Twingate Identity Firewall JWTs in common web frameworks. Each guide follows the same pattern: verify the ES256-signed JWT from the `Authorization` header, extract the user’s identity, and make it available to your application code. For architecture details and the full JWT reference, see the [Identity Firewall for Web Apps overview](/content/docs/web-app-access/index.html).

## Guides

### Express.js

Node.js middleware using the [jose](https://github.com/panva/jose) library. Attaches the verified identity to `req.twingateIdentity`.

[Express.js developer guide](/content/docs/web-app-express/index.html)

### Django

Python middleware using [PyJWT](https://pyjwt.readthedocs.io/). Attaches the verified identity to `request.twingate_identity`.

[Django developer guide](/content/docs/web-app-django/index.html)

### Next.js

Edge Middleware for the Next.js App Router using [jose](https://github.com/panva/jose). A thin middleware gates the routes you choose, and a reusable helper verifies the JWT to read the authenticated identity in route handlers and Server Components.

[Next.js developer guide](/content/docs/web-app-nextjs/index.html)

### Next.js + Auth.js

Combines Twingate Identity Firewall with [Auth.js](https://authjs.dev/) (NextAuth v5) sessions. Instead of passing identity via a request header, the middleware verifies the Twingate JWT and mints an Auth.js session cookie. This gives you `auth()` in Server Components and `useSession()` in Client Components.

[Next.js + Auth.js developer guide](/content/docs/web-app-nextjs-authjs/index.html)

Last updated 2 months ago