> ## Documentation Index
> Fetch the complete documentation index at: https://docs.jethings.com/llms.txt
> Use this file to discover all available pages before exploring further.

# JWT

> Generate and configure JWT secrets and token lifetimes

## Generate a JWT secret

Create a strong, random secret for signing tokens:

```bash theme={null}
# 256-bit secret for HS256 (recommended)
openssl rand -base64 32
```

Copy the output and set it as `JWT_SECRET` (or `AUTH_SECRET`) in each project's `.env`.

## Token lifetimes

Recommended defaults:

* **Access token:** `15 minutes`
* **Refresh token:** `7 days`

Use short-lived access tokens and longer-lived refresh tokens. Adjust the values based on your app's security and UX trade-offs.

## Refresh token handling

Keep refresh tokens secure:

* Store them in `httpOnly` cookies or a secure key store
* Rotate and invalidate them on logout and after password changes
* Revoke tokens server-side when a user logs out or a token is suspected to be leaked

## Example `.env`

```bash theme={null}
JWT_SECRET=your-openssl-generated-secret
JWT_ACCESS_EXPIRATION=15m
JWT_REFRESH_EXPIRATION=7d
```