I have an app where the user, after logging in, can generate a token with a customizable lifetime (30 days, 60 days, Never) It is similar to generating a personal access token in github. The user should be able to revoke the token whenever required. This token will be used by the user to call a set of apis. How would I go about implementing this? Does supertokens support this?

Yes. We do support this. The tokens that would be issued are JWTs. You can enable JWT support from our session recipe (in session.init). You can then create a new JWT (using the session recipe) with custom payload and custom lifetime in your API post session verification. You can return this JWT to the user as their personal access token.

The only issue with this is that you can’t revoke them by default. In order to do that, you can store a custom ID in the JWT, and also in your db. During JWT verification, you can check if that custom ID still exists in the db.

However, if you do that, you can also send just the custom ID as there access token anyway.. so it kind of beats the purpose of making a JWT, unless you want to use the JWT as also a way to store some custom payload info

@User Thank you for the response. The token will not need to store any custom payload other than a way to identify the user. Like github, I also want to alert the user via an email when his token is about to expire.

I see. So then it would make more sense to just handle this part yourself without supertokens, as we don’t add any value to this yet.

Thank you @User. Any advice how to go about it and what security considerations to factor in.

@User - Make sure the access token is generated with enough entropy and is long enough (>= 32 chars should be enough). You can use something equivalent to SecureRandom in Java (https://docs.oracle.com/javase/8/docs/api/java/security/SecureRandom.html) - You can store the associated userId and lifetime in your db against the token. Do not send these to the frontend. - From a performance point of view, you can cache this info and query the cache on each API call that uses the access token. - Send this token as an Authentication bearer token in API requests (see https://swagger.io/docs/specification/authentication/bearer-authentication/). - Make sure to check if the lifetime of the token has expired each time you authenticate the token from the db. - Set up a cronjob to remove expired tokens.

Thank you @User

Supertoken 🤝 Invide. I'm in both sides !

I have one suggestion to make on the Readme.md

Sure. What is it @samurize ?

The above image

make it a link to the website

or to the docs

should I drop in a PR?

Sure! A PR would help 🙂

Okay!

Thanks

Doing it now!

Thank you. Make it link to supertokens.com. We will be moving to that from the .io site very soon

okay

proper link?

@User on the discord part

why not add the link directly?

Cause if we ever want to change the discord link, it would be easier. And it allows us to get a rough estimate of how many people intend to join our discord server but don’t

Okay