- Implement JWT-based authentication system for device access
- Access tokens (7 day expiry) and refresh tokens (90 day expiry)
- HMAC-SHA256 signing with timing-safe comparison
- Token hashing with SHA-256 for secure storage
- Add device authentication endpoints:
- POST /api/auth/device/token - Login with email/password, get tokens
- POST /api/auth/device/refresh - Refresh access token
- POST /api/auth/device/verify - Verify token validity
- GET /api/auth/device/tokens - List user's API tokens
- DELETE /api/auth/device/tokens/[id] - Revoke specific token
- Track token usage (last used timestamp and IP)
2532f2d6ad