SuperTokens is an open source authentication solution offering features like: Different types of login: Email / password, Passwordless (OTP or Magic link based).

SuperTokens.com

Hey, I have enabled jwt in the sessions. i use the jwt token in a mobile app and i verify that the token i received is legit in the backend. 
My problem is that the jwt expires in 1 hour from its creation and i want to increase that expiration. 
Is there a setting/way that can achieve that? I know about the setting access_token_validity but i dont want to change the supertokens access_token expiration just the JWT that is created.

Yes you can:
```
Session.init({
    override: {
        openIdFeature: {
            jwtFeature: {
                functions: (oI) => {
                    return {
                        ...oI,
                        createJWT: async function (input) {
                            return oI.createJWT({
                                ...input,
                                validitySeconds: 123456
                            });
                        }
                    }
                }
            }
        }
    }
})
```

Whats the use case of doing this though? Why keep the access token's lifetime different than the JWT's?

i want the JWT for the mobile to be valid for a long time so the user wont have to sign in every 1 hour. The access token has a refresh token i can use which i use in the web app cause it can handle the cookies.

When the access token refreshes, then that also issues a new JWT. So if you are doing refreshing on the mobile app, then you can let the JWT lifetime be the way it is

But if you are not doing refreshing on the mobile app, then what you want makes sense

no, i wont be refreshing the token in the mobile cause i need the refresh token for that and i dont have it for the mobile. at least not in the current version we are doing.

I see. Okay. The refresh tokens are sent to the mobile client as well by the way. As cookies. But if you don’t need them, then alright.

im using a web login page for the mobile to login so the mobile app are not calling supertokens api directly. 
Is there a way to get the refresh and access token inside the web client so i could send it back to the mobile app upon login completion?

There isn't an easy way to do that since those are stored as httpOnly cookies.

If you want really want to do it though, you can send those back in the response body as well by overriding the sign up / sign in API and sending a custom response body. Alternatively, you can change the logic to not use cookies and use custom headers instead -> https://github.com/supertokens/supertokens-auth-react/tree/master/examples/with-localstorage.

Never mind then this is a good first version. Later we would change this so the mobile will do api calls to supertokens. 
Thanks for the help again.