Invalidate auth token?

Eli Beachy

Is there a way to invalidate a user's auth token when they log out of your application?

What about revoking all active tokens for a user?

And for how long is the token received on login valid?

Michael Udinski

Hi  

Once they log out and your front-end forgets the auth token, the user is in a state without an auth token so they'd have to go through the authentication flow again anyways. 

You can definitely create business logic + database schema to make it so a user must login again based on some condition defined and can check it/record it in the database. Perhaps even storing and deleting the auth token based on some conditions. There's many different ways you could go about this but it just takes extra work and then additional checks for each authenticated endpoint. 

The expiration of the authentication token is completely customizable. Just click on the function that Creates the Authentication Token and you can set the expiration to whatever you'd like. So maybe that is an easier solution for your use case by having a short expiration time. 

Jay

What about revoking a token after it got created, on xano's end?