Access Token Lifecycle

Access Token Lifecycle A lifecycle diagram generated by Archify. 01 / Token lifetime 02 / Interruptions + recovery 03 / Off the happy path Issued · @@viewer mints it · Token lifetime · HS256 · version 01 Issued @@viewer mints it HS256 · version Valid · carried in the request · Token lifetime · auth · tt · embed 02 Valid carried in the request auth · tt · embed Checked · signature · replay · Token lifetime · 503 if cache down 03 Checked signature · replay 503 if cache down Accepted · validation first · Token lifetime · no side effect 04 Accepted validation first no side effect Consumed · single-use is spent · Token lifetime · once only 05 Consumed single-use is spent once only Replayed · same token twice · Off the happy path · 403 replay Replayed same token twice 403 replay Expired · TTL or key rotated · Off the happy path · 403 re-issue Expired TTL or key rotated 403 re-issue Cache unavailable · replay store down · Interruptions + recovery · 503 retryable Cache unavailable replay store down 503 retryable load submit passes consume TTL elapsed store unreachable Legend start active state waiting decision terminal success failure / exit

One token per form load

  • • @@viewer mints it per form load
  • • Bound to form id and version

Replay and fail closed

  • • Replay state on disk; reuse is a 403
  • • Unreadable replay store: 503