Meteor 3.5: accounts-express Brings Meteor Accounts to Express

Meteor 3.5 introduces accounts-express, a package that integrates Meteor Accounts with Express routes, allowing developers to bring authenticated Meteor users into Express without building a separate session system. This integration preserves the Meteor authentication, data, and developer experience, making it easier to work with Express endpoints in Meteor applications.

To use accounts-express, install the package and add it to an Express route using createAuthMiddleware. This middleware reads a Meteor login token and attaches the resolved user ID to req.userId, allowing the application's existing login state to carry through to the HTTP layer. This means that account summaries, webhook follow-ups, and private API routes can reuse the signed-in user's identity without separate credentials, sessions, and user lookups.

For client code, use the package's authenticated fetch to make authenticated requests to Express routes. With the package's authentication enabled, signed-in clients will automatically include their Meteor login token in requests. This also makes the security boundary clear, as browser address bar visits do not automatically include the Meteor login token.

accounts-express simplifies integrating Meteor authentication with Express, making it easier to protect routes and maintain a consistent authentication experience across both layers. This integration is part of Meteor's ongoing modernization efforts and addresses long-standing integration gaps, allowing developers to focus on building their applications rather than building additional infrastructure.