Files

T

john-okeefe 8a6ea39ed2 docs(auth): document 7-day session authentication with constants

- Add comprehensive authentication overview.md explaining:
  - 7-day session duration for JWT and refresh tokens
  - Constants-based implementation (no hardcoded values)
  - Complete authentication flow (register/login/refresh/logout)
  - Session expiration handling (HTML redirect vs JSON error)
  - Security features (HTTP-only cookies, token rotation)
  - Token storage recommendations
- Update login.md with 7-day expires_in field and cookie MaxAge
- Update register.md with 7-day session duration details
- Update refresh_token.md with expires_in: 604800

Documentation provides complete reference for authentication
endpoints with examples and security considerations.

2026-02-16 16:50:43 -05:00

826 B

Raw Blame History

Refresh Token

Obtain a new JWT access token using a refresh token.

Endpoint: POST /api/auth/refresh Auth: Not required (uses refresh token) Content-Type: application/json

Request Body

Field	Type	Required	Description
refresh_token	string	Yes	Valid refresh token (UUID)

Example Request

{
  "refresh_token": "d4f5g6h7..."
}

Response (200 OK)

{
  "access_token": "new-jwt-token",
  "token_type": "Bearer",
  "expires_in": 604800
}

Session Duration: 7 days (604800 seconds)

The new access token is valid for 7 days from the time of refresh.

Error Responses

Code	Description
401	Invalid or expired refresh token
400	Missing refresh token or invalid format

826 B Raw Blame History