Stage 3 · Build
Advanced Auth & Tenant Security
Token Lifecycle
Rotate signing keys, revoke refresh tokens, store device sessions, and expire credentials safely.
8 min readBuilding Backend ApplicationsBuild
Token Lifecycle Overview
Tokens are issued, used, refreshed, and revoked. Managing this lifecycle prevents stolen tokens from persisting indefinitely and ensures signing keys are rotated regularly.
Key Rotation
Gosigning-key-rotation.go
44 linesLn 1, Col 1Go
Keep the previous key for verification during a grace period. Tokens signed with the old key remain valid until they expire. New tokens use the new key.
Refresh Token Revocation
Gorefresh-token-management.go
22 linesLn 1, Col 1Go
Revoke individual sessions or all sessions for a user. This is essential for security incidents — if a token is compromised, revoke it immediately.
Device Sessions
Godevice-session-tracking.go
30 linesLn 1, Col 1Go
Track each device session separately. Users can see where they are logged in and revoke specific sessions. This provides transparency and control.
Credential Expiry
| Credential | Lifetime | Action on Expiry |
|---|---|---|
| Access token | 15 minutes | Use refresh token |
| Refresh token | 30 days | Require re-authentication |
| API key | 90 days | Rotate and notify |
| Session cookie | 24 hours | Destroy session |
Token Audit
Gotoken-audit-logging.go
14 linesLn 1, Col 1Go
Log every token issuance, refresh, and revocation. Include IP and user agent for forensics. Store audit logs separately from application logs.
Show users their active sessions
Let users view all active sessions with device name, IP, and last active time. This builds trust and lets users identify unauthorized access.
Mark this lesson complete to store local progress and unlock a cleaner resume path the next time you visit.