Token Lifetimes & Configuration

Token and session lifetimes are configured in src/lib/oauth2/provider.ts. Signing keys are managed by src/lib/oauth2/keys.ts.

Token Lifetimes

Token Type	Expiry	Notes
Access Token	15 minutes	HS256 JWT signed with JWT_SECRET
Refresh Token	30 days	Rotated on every use (`rotate: true`). The previous refresh token is invalidated when a new one is issued.
Authorization Code	10 minutes	One-time use; invalidated after exchange

Supported Scopes

Defined in src/lib/oauth2/provider.ts via config.scopes.

Scope	Description	Claims
`openid`	OpenID Connect — required for all OIDC flows	sub
`profile`	Profile information	name
`email`	Email address	email
`offline_access`	Request a long-lived refresh token	(refresh_token)

JWKS Signing Keys

Token signing keys are generated in src/lib/oauth2/keys.ts and injected into the provider at startup via initJwksKeys() (called by ensureInitialized() in handlers.ts).

Key Configuration

Property	Value
Algorithm	RS256
Key Type	RSA 2048-bit
Key ID (kid)	`default`
Use	sig (signing)
Export Format	PEM (PKCS#8 private / SPKI public)

Key Loading Priority

1. Environment variables — If JWT_PRIVATE_KEY and JWT_PUBLIC_KEY are set (PEM format), they are used directly. This is the recommended approach for production.
2. Development generation — If env vars are not set, a new RSA 2048-bit keypair is generated on startup usingcrypto.generateKeyPairSync. Keys are cached in memory and reused for the process lifetime.

JWKS Endpoint

The public key is published at /.well-known/jwks.json and /jwks (alias). Clients use this to verify token signatures.

Loading…