JWT: What's a good secret key, and how to store it in an Node.js/Express app?
To generate a secret programatically you could use node's crypto.randomBytes()
var crypto = require('crypto');var jwt = require('jsonwebtoken');crypto.randomBytes(256, function(ex, buf) { if (ex) throw ex; var token = jwt.sign({foo: 'bar'}, buf); var decoded = jwt.verify(token, buf);});As for storing this, you're absolutely correct, you should definitely not store secrets in your source control. A better way would be to load such sensitive information from environment variables, eg process.env.MY_SECRET.
Another less common pattern I've seen is to load secrets from a file stored separate from your code. You could have your node app look for a JSON file in ~/.myapp/secrets.json for instance.