Expand description
Login and the token lifecycle.
The broker’s refresh token is SINGLE-USE: every successful refresh mints a new
one and invalidates the presented one atomically. A client that keeps sending
its original refresh token authenticates, refreshes once, and then fails with
Unauthenticated: invalid credential at the second refresh boundary — an hour
or a day later, far from the code that caused it. TokenManager persists the
rotated token, which is the whole reason it exists rather than leaving refresh
to callers.
Structs§
- Token
- A stored credential set.
expires_at_unixof 0 means “unknown”; the manager then treats the token as valid until an explicit refresh. - Token
Manager - Logs in and keeps the token fresh.