#NextAuth token best practices

3 messages · Page 1 of 1 (latest)

rapid ice
#

I'm setting up nextauth in a nextjs 13 app using credentials and email (login link) and jwt for session storage. I'm struggling to wrap my mind around the best practices for (1) creating an access token and (2) creating a new token (or refresh token) when it expires.

Currently, I'm creating the token in the login route, but that won't help with the email provider. I'm not sure if I should be creating the token in the jwt or session callback instead? Likewise, I'm not sure the best practice for checking token expiration and getting that back to the client.

Has anyone ever found a good example of this?
I'm can share code if that would help, and any assistance would be greatly appreciated.

gray sunBOT
#
Post created!

🔎 This post has been indexed in our web forum and will be seen by search engines so other users can find it outside Discord

      🕵️ Your user profile is private by default and won't be visible to users outside Discord, if you want to be visible in the web forum you can add the "Public Profile" role in <id:customize>

      ✅ You can mark a message as the answer for your post with `Right click -> Apps -> Mark Solution`
      (if you don't see the option, try refreshing Discord with Ctrl + R)
bitter oxide
#

I tried using https://authjs.dev/guides/basics/refresh-token-rotation

Refresh token rotation | Auth.js

Refresh token rotation is the practice of updating an accesstoken on behalf of the user, without requiring interaction (eg.: re-sign in). accesstokens are usually issued for a limited time. After they expire, the service verifying them will ignore the value. Instead of asking the user to sign in again to obtain a new accesstoken, certain provide...