HALODocs
Dashboard
Authentication

Sessions & JWT

Refresh rotation, RS256 access tokens, and JWKS.

Project Authentication issues short-lived RS256 access tokens and opaque rotating refresh tokens. Session policy is configured per project.

#Token model

TokenFormatUse
Access tokenRS256 JWTCall user-protected application APIs
Refresh tokenOpaque halo_rt_…Rotate the session
Provider login codeOne-time opaque codeComplete social sign-in
OAuth App tokenRS256 JWT + opaque refreshService-scoped access

#Refresh rotation

curl -X POST \
  "https://api.agihalo.com/api/v1/auth/token?grant_type=refresh_token" \
  -H "apikey: $HALO_PROJECT_PUBLISHABLE_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "refresh_token": "halo_rt_..."
  }'

#Verify access tokens

GET/api/v1/auth/.well-known/jwks.json

Fetch the project public JWK using the publishable-key header and cache it briefly. Validate all of the following:

  • Algorithm is RS256 and the JWT kid matches a JWK.
  • Issuer is halo-project:{projectId}.
  • Audience is halo-project-auth for project user tokens.
  • tokenUse is project_auth_access.
  • Expiry, project ID, subject, session ID, and email are present.
GET/api/v1/auth/user

Resolve a valid bearer access token to the current user. Send the matching Project publishable key as apikey.

#Revocation

POST/api/v1/auth/logout

Logout also requires the matching Project publishable key and user bearer token. The managed SDK sends both and clears its local session.

Project owners can also list active sessions and revoke an individual session from the dashboard. User ban or deletion makes future session validation unavailable.