@BoazWith Working from here the refresh endpoint is called sending the refreshToken through the Header to first verify if it's valid and new tokens are generated.
I just finished making a basic habit tracker and consistency mobile app. It's an expo react-native mobile app. The main aim was to improve my understanding on systems architecture. For now I'll touch a bit on how I've built the auth system, which uses jwts.
@BoazWith Great question, At this stage the refreshToken is still stored in expo's SecureStore and there's no accessToken because it was saved in memory.
When the accessToken expires, the refreshToken stored in expo's SecureStore is then sent to the backend through Headers, and verified, then the previous session is deleted and a new session is created and of course new access and refresh tokens are generated, continuing the cycle
A session is also concurrently created in redis to store user sessions and it's using a session key to uniquely identify each user by using the user's id and the deviceId generated from the frontend.
So when the user signs/logs in, both access and refresh tokens are generated in the backend, then sent to the frontend, accessToken being saved in memory(Zustand in this case) and refreshToken being saved in expo's very own SecureStore.
The landing page for my app is out!
Took me a few hours with Codex and Astro and deployed on CloudFlare Pages in minutes.
I'd really appreciate some beta testers for the Android version.
Reply if interested and share for reach ❤️. Bless the clankers!