Henry_CQ: I have one architecture-related question about authentication?
When an authenticated request reaches the NCB API, does NoCodeBackend verify the JWT and execute the Pre Hook before performing any database lookup?
In other words, if the Pre Hook doesn't use the DB Query block, can authentication and authorization be completed using only the verified JWT claims without reading the database, or does NoCodeBackend always perform a database lookup for authenticated requests?
Riya_NoCodeBackend
Aug 5, 2026A: Hi there,
Great question!
To answer directly: NoCodeBackend always performs a database lookup for authenticated requests before any Pre Hooks are executed.
Here’s a high-level overview of the request flow:
Authentication First: When an authenticated request arrives, we don't rely solely on stateless JWT claims. Instead, our authentication layer checks your database to ensure the session is currently active, valid, and hasn't been revoked.
Pre Hooks Execution: Once the session is fully validated against the database, the request moves forward, and any configured Pre Hooks are executed.
Because we use stateful sessions for enhanced security and instant revocation, authentication and authorization cannot be completed using only the token claims. A database read is always required to validate the session before your Pre Hook runs, even if the Pre Hook itself doesn't contain a Database Query block.
Let us know if you have any other questions!