Skip to Content
Framework GuidesExpress.js

Deploy Express.js

1. Initialize

cd my-express-app
ghayma init
.ghayma.json
{
  "name": "my-express-app",
  "framework": "express",
  "build_command": "npm install",
  "start_command": "node index.js",
  "port": 3000
}

2. Listen on the Correct Port

Ensure your app reads the PORT environment variable:

index.js
const express = require("express");
const app = express();
 
const PORT = process.env.PORT || 3000;
 
app.get("/", (req, res) => {
  res.json({ message: "Hello from Ghayma!" });
});
 
app.listen(PORT, () => console.log(`Server running on port ${PORT}`));

3. Deploy

ghayma deploy

Using with TypeScript

.ghayma.json
{
  "name": "my-express-app",
  "framework": "express",
  "build_command": "npm run build",
  "start_command": "node dist/index.js",
  "port": 3000
}

Add a Database

# Create a PostgreSQL database and connect it to the 'main' site — its
# DATABASE_URL is derived for every site connected to it
ghayma db create my-db --site main

Leave out --site and, on a terminal, the command asks instead. The running app picks the variable up once the database accepts logins — usually within a minute — and every deploy derives it again; there is nothing to env set. See Automatically injected variables.

// DATABASE_URL comes from the platform
const { Pool } = require("pg");
const pool = new Pool({ connectionString: process.env.DATABASE_URL });

Internal Networking: If your Express app connects to Ghayma services (Auth, databases, storage API), use internal URLs for deployed apps. See the Networking Guide.

Auth Middleware

Tokens issued by a Ghayma Auth App are RS256 JWTs that you verify locally against the app’s JWKS — the Server SDK does not verify tokens. Create lib/auth.ts from JWT Verification, then:

import { verifyAccessToken } from "./lib/auth";
 
app.use("/api", async (req, res, next) => {
  const token = req.headers.authorization?.replace("Bearer ", "");
  if (!token) return res.status(401).json({ error: "Unauthorized" });
 
  try {
    req.user = await verifyAccessToken(token);
    next();
  } catch {
    res.status(401).json({ error: "Invalid token" });
  }
});

verifyAccessToken throws on an invalid or expired token — there is no valid flag to check. See the full Express example for the TypeScript req.user declaration.

Next.jsNuxt