Skip to content

Installation

To begin, simply add the javalin-security library to your project dependencies. This is all you need for the minimum setup to enable authentication and authorization features in your Javalin app.

dependencies {
    implementation("io.github.mzlnk:javalin-security:0.2.0")
    implementation("io.javalin:javalin:7.2.2")
    implementation("org.slf4j:slf4j-simple:2.0.16")
}

<dependency>
  <groupId>io.github.mzlnk</groupId>
  <artifactId>javalin-security</artifactId>
  <version>0.2.0</version>
</dependency>
<dependency>
  <groupId>io.javalin</groupId>
  <artifactId>javalin</artifactId>
  <version>7.2.2</version>
</dependency>
<dependency>
  <groupId>org.slf4j</groupId>
  <artifactId>slf4j-simple</artifactId>
  <version>2.0.16</version>
</dependency>

Verify the setup

Start Javalin with a minimal security block. If it boots without errors, the library is wired correctly.

import io.github.mzlnk.javalin.security.authorization.Rules
import io.github.mzlnk.javalin.security.security
import io.javalin.Javalin

fun main() {
    Javalin.create { config ->
        config.security { security ->
            security.http.fallback = Rules.allow()
        }
        config.routes.get("/") { it.result("ok") }
    }.start(7070)
}

import io.github.mzlnk.javalin.security.JavalinSecurityPlugin;
import io.github.mzlnk.javalin.security.authorization.Rules;
import io.javalin.Javalin;

void main() {
    Javalin.create(config -> {
        config.registerPlugin(new JavalinSecurityPlugin(security ->
            security.http.fallback = Rules.allow()));
        config.routes.get("/", ctx -> ctx.result("ok"));
    }).start(7070);
}

Choose an extension

The javalin-security library itself does not include any built-in authentication mechanism. You need to either implement your own authentication strategy, or use one of the provided extensions designed for common authentication scenarios — so you don't have to build everything from scratch. Each extension's page includes its installation snippet:

Extension For
Basic Auth HTTP Basic (RFC 7617)
API Key Opaque API keys (X-Api-Key)
Opaque Token Server-issued opaque bearer tokens
Session HTTP-session cookie auth
JWT Verified JWTs (HTTP / WebSocket)
Custom authentication mTLS, HMAC, other schemes

Next steps