User Module Options

In this guide, you'll learn about the options you can pass to the User Module.

Options Example#

medusa-config.ts
1module.exports = defineConfig({2  // ...3  modules: [4    {5      resolve: "@medusajs/medusa/user",6      options: {7        jwt_secret: process.env.JWT_SECRET,8        jwt_public_key: process.env.JWT_PUBLIC_KEY,9        valid_duration: 60 * 60 * 24, // 24 hours10        jwt_options: {11          algorithm: process.env.JWT_ALGORITHM || "RS256",12          issuer: process.env.JWT_ISSUER || "medusa",13        },14        jwt_verify_options: {15          algorithms: [process.env.JWT_ALGORITHM || "RS256"],16          issuer: process.env.JWT_ISSUER || "medusa",17        },18      },19    },20  ],21})

Environment Variables#

Make sure to add the necessary environment variables for the above options to your .env file:

Terminal
❯JWT_SECRET=supersecret❯# Optional: For asymmetric key validation❯JWT_PUBLIC_KEY=your_public_key_here❯JWT_ALGORITHM=RS256❯JWT_ISSUER=medusa

All Options#

Option	Description	Required	Default
`jwt_secret`	A string indicating the secret used to sign the invite tokens.	Yes	-
`jwt_public_key`	A string indicating the public key used to verify JWT tokens when using asymmetric validation. Only used when the JWT secret is a private key for asymmetric signing. Learn more in the Asymmetric Encryption guide.	No	-
`valid_duration`	A number indicating the duration in seconds that an invite token is valid. This is used to set the expiration time for invite tokens.	No	`86400` seconds (`1` day)
`jwt_options`	An object containing options for signing JWT tokens when using asymmetric signing with a private/public key pair. Accepts any options from jsonwebtoken's SignOptions, such as `algorithm`. If `expiresIn` is provided here, it will be used as a fallback if `valid_duration` is not set. Learn more in the Asymmetric Encryption guide.	No	`{}`
`jwt_verify_options`	An object containing options for verifying JWT tokens when using asymmetric validation with a private/public key pair. Accepts any options from jsonwebtoken's VerifyOptions, such as `algorithms`. If not provided, the `jwt_options` will be used for verification. Learn more in the Asymmetric Encryption guide.	No	Value of `jwt_options`

Was this page helpful?