JWT Access Token Patterns — Short-Lived Access Token Design and Refresh Strategies

In this tutorial, you will learn about JWT Access Token Patterns. We cover key concepts, practical examples, and best practices to help you master this topic.

JWT access token patterns cover the design of short-lived access tokens (5-15 minute TTL), combined with refresh token rotation and silent refresh, balancing security with user experience across web, mobile, and SPA clients.

What You'll Learn

• Optimal access token TTL per client type
• Refresh token rotation patterns
• Silent refresh for seamless UX
• Access token reuse detection
• Graceful token expiry handling

flowchart LR
    A["Client Types and Access Token Patterns"] --> B["Web App (server)"]
    A --> C["SPA (browser)"]
    A --> D["Mobile App"]
    A --> E["CLI Tool"]

    B --> B1["15-min access token"]
    B --> B2["httpOnly refresh cookie"]
    B --> B3["Server-side refresh"]

    C --> C1["5-min access token (memory)"]
    C --> C2["httpOnly refresh cookie"]
    C --> C3["iframe silent refresh"]

    D --> D1["10-min access token"]
    D --> D2["Keychain refresh storage"]
    D --> D3["Background token refresh"]

    E --> E1["1-hour access token"]
    E --> E2["Keyring refresh storage"]
    E --> E3["On-demand refresh"]

What's Next

Apply patterns to {{< ilink "JWT" "JWT Access Tokens" }} and combine with {{< ilink "JWT" "JWT Refresh Tokens" }} for complete token lifecycle management.