Jun 11, 2026·1 min read
JWT roles on Doc Appoint
How I split a React client and an Express API so appointment booking is not a public POST.
#jwt#mern#express
Doc Appoint is a doctor-booking UI with a real backend next to it. The client lives in doc-appoint-client. The API lives in doc-appoint-server. That split is the part I would talk through in an interview.
Why two repos
A single Vite app can fake booking with local state. I wanted a token in Authorization and a Mongo collection the UI does not own. JWT means the browser can lose the session without losing the server rules.
What the client does
- Browse specialties and doctor cards
- Send booking requests only after a token exists
- Keep Tailwind layouts usable on a phone
What the server does
- Issue and verify JWTs
- Guard booking routes
- Talk to MongoDB so slots are not just React state
I do not treat the marketing counters on the live landing page as product metrics. They are assignment chrome. The reviewable work is the client/server cut and the protected booking path.
Live demo: Doc Appoint