Skip to main content
TypeLifetime
Access token1 hour
Refresh token30 days

​
Decoded payload

{"sub":"user-uuid","email":"user@example.com","organizationId":"org-uuid","roles":["claims_manager"]}
Each refresh token use rotates both tokens — the old pair is immediately invalidated.