HALODocs
Dashboard
Authentication

Sessions & JWT

Refresh rotation, RS256 access tokens, and JWKS.

Project Authentication issues short-lived RS256 access tokens and opaque rotating refresh tokens. Session policy is configured per project.

#Token model

TokenFormatUse
Access tokenRS256 JWTCall user-protected application APIs
Refresh tokenOpaque halo_auth_rt_…Rotate the session
Provider login codeOne-time opaque codeComplete social sign-in
OAuth App tokenRS256 JWT + opaque refreshService-scoped access

#Refresh rotation

curl -X POST \
  "https://api.agihalo.com/api/v1/auth/token?grant_type=refresh_token" \
  -H "apikey: $HALO_PROJECT_PUBLISHABLE_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "refresh_token": "halo_auth_rt_..."
  }'

#Verify access tokens

GET/api/v1/auth/.well-known/jwks.json

Fetch the project public JWK using the publishable-key header and cache it briefly. Validate all of the following:

  • Algorithm is RS256 and the JWT kid matches a JWK.
  • Issuer is halo-project:{projectId}.
  • Audience is halo-project-auth for project user tokens.
  • tokenUse is project_auth_access.
  • Expiry, project ID, subject, session ID, and email are present.
GET/api/v1/auth/user

Resolve a valid bearer access token to the current user.

#Revocation

POST/api/v1/auth/logout

Project owners can also list active sessions and revoke an individual session from the dashboard. User ban or deletion makes future session validation unavailable.