Session tokens

Keyward keeps two things for a signed-in user: a long-lived session, and a short-lived session token your API verifies on every request.

A short-lived token passing from the browser to your API

The token lives for 60 seconds and is refreshed in the background, so a revoked session stops working within a minute without a database lookup per request.

Claims

Claim	Meaning
`sub`	The user ID
`sid`	The session ID
`tid`	The active team, if any
`exp`	Expiry, 60 seconds after issue

Updated Oct 12, 2026

What did you think of this content?