OAuth 2.1 and PKCE

What is implemented#

Full authorization code flow
PKCE enforced, not optional
Refresh token rotation on every use
Reuse detection backed by Redis, verified in tests against real Redis rather than a mock

Token model#

Access tokens are JWTs signed with RS256. middleware.ts verifies them with the public key only, which means the private key never reaches Edge Runtime. Tokens live for 15 minutes.

That is a deliberate trade-off: stateless tokens mean revoking a client does not invalidate tokens already issued, they expire naturally instead. If you need immediate revocation, add a revocation check in middleware.ts. See trade-offs.

Reuse detection#

When a rotated refresh token is presented a second time, the whole token chain is revoked. A stolen refresh token therefore burns itself the moment either party uses it after the legitimate holder.

Where clients do not support OAuth#

Use API keys. Both paths land on the same authorization layer, so your usage reporting and quota behave identically.