token-storage
Installation
SKILL.md
Token Storage, Rotation, and Revocation
Instructions
Treat tokens as short-lived credentials with a clear lifecycle. Storage alone is not enough — rotation and revocation matter just as much.
1. Split Access and Refresh Tokens
| Token | Lifetime | Where it lives |
|---|---|---|
| Access token (JWT or opaque) | 5–60 min | In-memory, optionally in Keychain for cold-start resume. |
| Refresh token | Hours → days (with rotation) | Keystore / Keychain only. |
id_token (OIDC) |
Same as access | In memory; used for claims only, not for auth headers. |
Access tokens in memory survive backgrounding but are lost on process death — that is acceptable if refresh is cheap.
2. Refresh Token Rotation
Rotation is mandatory for public clients (RFC 6749bis / OAuth 2.1):