JWT - j-store

Generate a JWT secret

Create a strong, random secret for signing tokens:

# 256-bit secret for HS256 (recommended)
openssl rand -base64 32

Copy the output and set it as JWT_SECRET (or AUTH_SECRET) in each project’s .env.

Token lifetimes

Recommended defaults:

Access token: 15 minutes
Refresh token: 7 days

Use short-lived access tokens and longer-lived refresh tokens. Adjust the values based on your app’s security and UX trade-offs.

Refresh token handling

Keep refresh tokens secure:

Store them in httpOnly cookies or a secure key store
Rotate and invalidate them on logout and after password changes
Revoke tokens server-side when a user logs out or a token is suspected to be leaked

Example `.env`

JWT_SECRET=your-openssl-generated-secret
JWT_ACCESS_EXPIRATION=15m
JWT_REFRESH_EXPIRATION=7d