Refresh token length should be configurable (currently hardcoded to 12)

[opxdelwin]

Current behavior

Refresh tokens are hardcoded to 12 alphanumeric characters in internal/models/refresh_token.go:

Token: crypto.SecureAlphanumeric(12),

Problem

12 characters is a short token for a credential that can live for days or weeks. While token rotation mitigates some risk, a stolen token within its reuse interval is still exploitable — and a longer token raises the bar meaningfully.

This also causes friction with client-side validation in some SDKs and native apps that expect tokens of a more typical length (e.g. 32+ chars).

Suggested fix

Either:

• Increase the hardcoded length to 32 (one-line change, no breaking changes), or
• Expose it as a configurable env var (e.g. GOTRUE_REFRESH_TOKEN_LENGTH)

References

• Community discussion: https://github.com/orgs/supabase/discussions/38216