All authenticated API routes expect a Bearer token in the Authorization header:
Tokens are signed with SECRET_KEY from the environment and stored on the user document as loginToken. The server rejects tokens that do not match the stored session value.

​
Middleware types

​
isAdmin

Verifies the JWT, loads the user from MongoDB, confirms loginToken matches, and requires role === 'admin'. Attaches req.user = { id, type }.

​
isAuth

Same token and session checks as isAdmin, but accepts any active role (admin or user).

​
isToken(allowedPages?)

Factory middleware. Validates token and session for any role. If allowedPages is provided (e.g. [PageAccess.NIFTY_50]), non-admin users must have at least one matching index setting in their pageAccess array. Admins always pass. Used by index-data routes and several user endpoints (updateUser, logout, verify-mfa, resetPassword).

​
isUser(allowedPages?)

Factory middleware. Same as isToken, but additionally requires role === 'user'. Non-admin users without matching page access receive 403 Access denied to this page.
isToken and isUser are higher-order functions — call them to get the middleware: isToken(), isToken([PageAccess.BANK_NIFTY]).

​
JWT payload

Tokens are generated at login with:

​
Session invalidation

A token becomes invalid when:
  • The user logs out (loginToken cleared)
  • Another session forces login (isForceLogin)
  • The user is soft-deleted or deactivated
  • Admin invalidates the session externally
See User lifecycle for the full login and MFA flow.