Cloned from this repo .
By default in .env.example file the authentication token is valid for about 30 minutes. The refresh token can be used upto 30 days.
Send verification email will send an email with the token which is valid for 10 minutes to verify the email and isEmailVerified is set to true.
Similarly reset password token is valid upto 10 minutes as well.
First when a user registers or logs in, a auth (30 min) and a refresh token(30 days) is generated or sent in the response.
After 30 min, the user has to send the refresh token in body as POST to /v1/auth/refresh-tokens to get a response similar to register or login. The user can now use the newly generated auth token for authenticated routes and continue doing so.
With no or expired auth token and expired refresh token, the user haslittle or no choice but to login again with his credentials.
Similar to login, but refresh token is not sent.
A user must be logged in to create an user with the user or admin roles. During register the user is created with user role.
The logged in user can now get and update his user info.