Skip to content

Implement JWT token refresh mechanism #275

Description

@DeFiVC

What

The API issues JWT tokens with a 24-hour expiry but lacks a refresh token mechanism, requiring users to re-authenticate when tokens expire.

Why

  • 24-hour tokens force users to reconnect their wallet frequently
  • No way to extend sessions without full re-authentication
  • Poor user experience for active users

Scope

Implement refresh token flow:

  1. Issue refresh token alongside access token
  2. Add /auth/refresh endpoint
  3. Frontend stores and uses refresh tokens

Acceptance Criteria

  • Refresh token issued with access token (longer expiry, e.g., 7 days)
  • POST /auth/refresh endpoint accepts refresh token and returns new access token
  • Refresh tokens are single-use (rotation)
  • Frontend handles token refresh automatically
  • Expired access tokens are transparently refreshed

Technical Context

  • API files: src/modules/auth/, src/config/index.ts
  • Frontend files: src/lib/api/auth.ts (has refreshToken function), src/lib/api/client.ts
  • Current: Only access token with 24h expiry
  • Database: May need refresh_tokens table

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

Stellar WaveIssues in the Stellar wave programhigh

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions