Which UI do you use?

Custom UI

Pre built UI

Access Token signing key rotation

About

Access Token signing key rotation implies that the secret key for signing the access tokens will be changed at a fixed time interval. This reduces the risk of key theft.

info

• Existing logged in users are not logged out on key change.
• This feature is enabled by default.

Changing the key rotation interval

With Docker

docker run \
  -p 3567:3567 \
  -e ACCESS_TOKEN_DYNAMIC_SIGNING_KEY_UPDATE_INTERVAL=168 \
  -d registry.supertokens.io/supertokens/supertokens-<db name>

Without Docker

# You need to add the following to the config.yaml file.
# The file path can be found by running the "supertokens --help" command

access_token_dynamic_signing_key_update_interval: 168

• access_token_dynamic_signing_key_update_interval
  • Time in hours for how frequently the signing key will change.
  • It must be set to a number value with, the default value set to 168

info

For managed service, this value can be updated by visiting our dashboard.

Using static keys to sign access tokens

If you do not want to use dynamic keys for session creation, then you can tell SuperTokens to use the static key instead. This is useful in cases where you want to hardcode the public key for JWT verification in some process.

NodeJS

Important

For other backend frameworks, you can follow our guide on how to spin up a separate server configured with the SuperTokens backend SDK to authenticate requests and issue session tokens.

GoLang

import SuperTokens from "supertokens-node";
import Session from "supertokens-node/recipe/session";

SuperTokens.init({
    supertokens: {
        connectionURI: "...",
    },
    appInfo: {
        apiDomain: "...",
        appName: "...",
        websiteDomain: "..."
    },
    recipeList: [
        Session.init({
            useDynamicAccessTokenSigningKey: false,
        })
    ]
});

caution

Updating this value will cause a spike in the session refresh API, as and when users visit your application.

Python

import (
    "github.com/supertokens/supertokens-golang/recipe/session"
    "github.com/supertokens/supertokens-golang/recipe/session/sessmodels"
    "github.com/supertokens/supertokens-golang/supertokens"
)

func main() {
    useDynamicAccessTokenSigningKey := false

    supertokens.Init(supertokens.TypeInput{
        RecipeList: []supertokens.Recipe{
            session.Init(&sessmodels.TypeInput{
                UseDynamicAccessTokenSigningKey: &useDynamicAccessTokenSigningKey,
            }),
        },
    })
}

caution

Updating this value will cause a spike in the session refresh API, as and when users visit your application.

Other Frameworks

from supertokens_python import init, InputAppInfo
from supertokens_python.recipe import session

init(
    app_info=InputAppInfo(api_domain="...", app_name="...", website_domain="..."),
    framework='...', 
    recipe_list=[
        session.init(
            use_dynamic_access_token_signing_key=False
        )
    ]
)

caution

Updating this value will cause a spike in the session refresh API, as and when users visit your application.