Instructions 1. Set Up API Key (Recommended)

Go to Settings → API in your Bubble editor
Add a new API key called JWT_SECRET
Enter your secret key value (keep this secure!)

2. Create a Backend Workflow

Navigate to Backend workflows in your Bubble editor
Click New API workflow and name it generate_token
Set up parameters for your workflow:

Add parameter user_id (text)
Add parameter email (text)
Add any other data you want to include in the token



3. Add the JWT Encode Action

In your backend workflow, click Add an action
Select Plugins → Encode JWT
Configure the action:

json data: Build your JSON object
{
 "user_id": "user_id's value",
 "email": "email's value",
 "issued_at": "Current date/time:formatted as UNIX"
}

Secret: Use Get data from API provider → JWT_SECRET
Expiration: 60 (for 1 hour) or your preferred duration in minutes



4. Return the Token

Add action Return data from API
Set the return value to Result of step 1's token

5. Call from Frontend
In your frontend workflows (e.g., after login):

Add action Schedule API Workflow
Select generate_token
Pass the required parameters
Use the returned token for API calls or store it

Example Use Cases
User Authentication Flow

User logs in successfully
Trigger backend workflow to generate JWT
Store token in custom state or database
Include token in API headers for authenticated requests

API Integration
Authorization: Bearer [your-generated-token]
Security Best Practices

Never expose your secret key in frontend workflows
Always use backend workflows for token generation
Set appropriate expiration times
Rotate your secret keys periodically
Store sensitive user data in your database, not in the JWT

Testing Your Implementation

Create a test button in your app
Set up a workflow that calls your generate_token API
Display the result in a text element to verify token generation
Use jwt.io to decode and verify your tokens (never paste production tokens!)

Troubleshooting

"payload is required" error: Ensure your JSON data field contains valid JSON
Invalid token: Check that your secret key matches between encoding and decoding
Token expired: Verify your expiration time is set correctly (in minutes)