Sessions and tokens

After a user connects, your server holds two tokens for them. Keep them safe, refresh the access token when it expires, and clear them when the user signs out.

The two tokens

Token	Used for	Lifetime
Access token	Sent with every AI request and to get the user profile.	30 minutes
Refresh token	Gets a new access token without asking the user to sign in again.	30 days

Refresh the access token

When an AI request fails with HTTP 401 (the access token expired), refresh it and retry the request once.

javascript

const tokens = await auth.refreshAccessToken(session.refreshToken);
session.accessToken = tokens.access_token;
session.refreshToken = tokens.refresh_token; // refresh tokens rotate: always keep the new one

Refresh tokens rotate

Each refresh returns a new refresh token and the old one stops working. Always save the new one. If the refresh itself fails, clear the session and send the user through Connect with rNet again.

Store tokens safely

Keep tokens in a server-side session or encrypted database row, never in localStorage or sessionStorage.
If you use a session cookie, make it HttpOnly, Secure and SameSite=Lax.
Keep the Client secret in an environment variable on the server.

javascript

// Express example
app.use(session({
  secret: process.env.SESSION_SECRET,
  resave: false,
  saveUninitialized: false,
  cookie: { httpOnly: true, secure: true, sameSite: 'lax' },
}));

Sign the user out

Destroy the session that holds the user's rNet tokens. Once their refresh token expires, your app can no longer act for them.

javascript

app.post('/logout', (req, res) => {
  req.session.destroy(() => {
    res.clearCookie('connect.sid');
    res.redirect('/');
  });
});