Sessions

The Sessions page lets you configure how JSON Web Tokens (JWTs) are issued for the current environment. You can manage signing keys, adjust token lifetime and clock skew, and preview the claims structure, all from Authentication > Sessions (/dashboard/authentication?tab=sessions).

Signing keys

Signing keys are the JSON Web Keys (JWKs) used to sign access tokens for your environment. The page displays three stats cards summarizing key status:

Below the stats cards, a table lists all signing keys with the following columns:

Create a signing key

Click "New JSON Web Key" in the card header to open the creation dialog. Select the desired algorithm from the dropdown (default: RS256) and click "Save Key". The new key is created in an Inactive state.

Activate a key

Click "Use Key" on an inactive key row. Only active keys are used to sign new tokens. You can have multiple active keys to support key rotation.

Revoke a key

Click "Revoke" (destructive style) on an inactive key row. Revoked keys remain listed for auditing but are never used to sign new tokens. Tokens previously signed with a revoked key can still be verified using the public key from the JWKS endpoint until they expire.

Rotate keys without downtime

Rotation works because verification and signing are separate concerns: the JWKS endpoint publishes every non-revoked public key, while only active keys sign new tokens. So:

1. Create a new key. It starts Inactive — published for verification, not yet signing.
2. Wait for your consumers to refresh their cached JWKS.
3. Use Key on the new key so it starts signing.
4. Leave the old key inactive until every token it signed has expired (at least one Token Lifetime).
5. Revoke the old key.

Skipping step 4 rejects tokens that are still legitimately in flight.

JWT settings

The JWT Settings section controls how tokens are issued for the current environment. Two range sliders let you configure:

The current value in seconds is displayed below each slider. Adjust the sliders and click "Save Settings" to apply changes. The button is disabled until you change a value. The new settings take effect for all tokens issued after saving.

Claims preview

The claims preview panel shows a live JSON representation of the JWT payload structure for the current environment. It is displayed in a dark-themed code block alongside the JWT settings form. The preview dynamically reflects the current token lifetime value as you adjust the slider.

{
  "root": {
    "iss": "https://id.authdog.com",
    "iat": "{{ ISSUED_TIME }}",
    "exp": "{{ ISSUED_TIME + tokenLifetime }}",
    "groups": "{{user.groups}}",
    "sub": "{{user.externalId}}:{{user.environmentId}}"
  }
}

Use this preview to verify the shape and expiry of tokens your application will receive before saving changes.

Supported algorithms

Ed25519 keys are advertised as EdDSA in the OIDC discovery document, which is the algorithm identifier JWT libraries expect.

Adding your own claims

The preview above shows the claims Authdog issues by default. To add your own — roles, groups, metadata values, or static literals — use Authentication > JWT Claims, which writes them into the same token.

Related