title: JWT Authentication Tokens With JSON:API
body: <p>I am creating a JSON API that implements the <a href="https://jsonapi.org/format/" rel="nofollow noreferrer">JSON:API</a> specification. I have a question about it however, and this question applies more generally to RESTful design in general: What is the recommended way to handle the &quot;creation&quot; of a resource, where one of the attributes is &quot;calculated&quot; by the server?</p>
  <p>In my example, I have a <code>POST /auth/tokens</code> endpoint that accepts a user's credentials and returns a <a href="https://datatracker.ietf.org/doc/html/rfc7519" rel="nofollow noreferrer">JWT</a>. I've used a POST endpoint, because it seems to me that we are <strong>creating</strong> a token resource, even if that token is not saved to a database. However, according to JSON:API, what would the proper request/response look like? This?:</p>
  <pre class="lang-json prettyprint-override"><code>POST /auth/tokens
  
  {
    &quot;data&quot;: {
      &quot;type&quot;: &quot;tokens&quot;,
      &quot;attributes&quot;: {
        &quot;email&quot;: &quot;...&quot;,
        &quot;password&quot;: &quot;...&quot;
      }
    }
  }
  </code></pre>
  <p>However, does it even make sense to create a token <strong>with</strong> an email and password? It seems that it would be creating a token <strong>for</strong> an email/password. Is there a difference?</p>
  <p>More importantly, what would the response look like? It seems like it would look something like:</p>
  <pre class="lang-json prettyprint-override"><code>{
    &quot;data&quot;: {
      &quot;type&quot;: &quot;tokens&quot;,
      &quot;attributes&quot;: {
        &quot;token&quot;: &quot;...&quot;
      }
    }
  }
  </code></pre>
  <p>But the specification states:</p>
  <blockquote>
  <p>Every resource object MUST contain an id member and a type member. The values of the id and type members MUST be strings.</p>
  </blockquote>
  <p>Since the tokens aren't saved to the database, I don't really have an ID for them. What should I do?</p>