Technical Report 003 · HashVault · Konnect
JWT Rotation and Authentication Architecture
Short-lived access, opaque refresh, and a stolen token that cannot be replayed.
Issue 01 · June 2026 · Filed under: Security · Authentication
§1 Two tokens, two lifetimes
HashVault issues a 15-minute HS256 access token carrying the user's ID and email, and a 64-character opaque refresh token valid for seven days. The access token is verified statelessly; the refresh token is checked against Redis.
§2 Never store the secret
Refresh tokens are never stored in plaintext. Redis holds refresh_token:{sha256(token)} — a leaked Redis snapshot contains nothing a client could present.
§3 Rotate on every use
Every call to /refresh deletes the old key before issuing a new pair. A refresh token works exactly once, so a stolen one is either already spent or revealed the moment both parties try to use it.
§4 Fail closed
If Redis is unavailable, refresh fails rather than waving the request through. Rate limiting fails open; authentication never does.
Konnect takes the asymmetric route: RS256, where only the auth service holds the private key and the other five services verify with the public half.