Sessions

The Sessions page lets you configure how JSON Web Tokens (JWTs) are issued for the current environment. You can manage signing keys, adjust token lifetime and clock skew, and preview the claims structure — all from Security > Sessions (/dashboard/security?tab=sessions).

Signing keys

Signing keys are the JSON Web Keys (JWKs) used to sign access tokens for your environment. The page displays three stats cards summarizing key status:

Below the stats cards, a table lists all signing keys with the following columns:

Create a signing key

Click "New JSON Web Key" in the card header to open the creation dialog. Select the desired algorithm from the dropdown (default: RS256) and click "Save Key". The new key is created in an Inactive state.

Activate a key

Click "Use Key" on an inactive key row. Only active keys are used to sign new tokens. You can have multiple active keys to support key rotation.

Revoke a key

Click "Revoke" (destructive style) on an inactive key row. Revoked keys remain listed for auditing but are never used to sign new tokens. Tokens previously signed with a revoked key can still be verified using the public key from the JWKS endpoint until they expire.

Caution

Revoking a key is permanent. Once revoked, a key cannot be reactivated. Ensure you have at least one active key before revoking others.

JWT settings

The JWT Settings section controls how tokens are issued for the current environment. Two range sliders let you configure:

The current value in seconds is displayed below each slider. Adjust the sliders and click "Save Settings" to apply changes. The button is disabled until you change a value. The new settings take effect for all tokens issued after saving.

Tip

A token lifetime of 3,600 seconds (1 hour) is a reasonable default for most applications. Reduce it for high-security environments or increase it for long-lived sessions.

Claims preview

The claims preview panel shows a live JSON representation of the JWT payload structure for the current environment. It is displayed in a dark-themed code block alongside the JWT settings form. The preview dynamically reflects the current token lifetime value as you adjust the slider.

{
  "root": {
    "iss": "https://id.authdog.com",
    "iat": "{{ ISSUED_TIME }}",
    "exp": "{{ ISSUED_TIME + tokenLifetime }}",
    "groups": "{{user.groups}}",
    "sub": "{{user.externalId}}:{{user.environmentId}}"
  }
}

Use this preview to verify the shape and expiry of tokens your application will receive before saving changes.

Supported algorithms

Related