server.js

    const express    = require('express')
    const bodyParser = require('body-parser')
    const jwt = require('express-jwt')

    const app = express()

    app.use(bodyParser.json())
    app.use(bodyParser.urlencoded({ extended: false }))

    // authentication middleware
    const auth = jwt({secret: 'somesuperdupersecret'})

    app.get('/comments', (req, res) => {
      res.json('All comments')
    })

    // secured endpoint
    app.post('/comments/create', auth, (req, res) => {
      // return error if user is not authenticated
      if (!req.user){
        return res.status(401).send('You are not authorized')
      }

      // create comment
      const comment = {...}

      res.json({
        message: 'Comment created!',
        data: comment
      })
    })

    app.listen(3000, () => {
      console.log('Server is up on 3000')
    })