Securing Our API with Short-Lived JWTs

A leaked token that's valid for 30 days is a 30-day breach. We cut access-token lifetime to 10 minutes and paired it with rotating refresh tokens.

The shape

• Access token: 10 minutes, stateless, carries scopes.
• Refresh token: rotated on every use, stored hashed, revocable.

// Verify with a tight clock skew and an explicit algorithm allow-list
jwt.verify(token, publicKey, { algorithms: ["RS256"], clockTolerance: 5 });

The cost is more refresh traffic. The benefit is that a stolen access token is nearly worthless in ten minutes.