Rotate refresh tokens, manage device sessions, and stop future renewal. Keep access-token issuance and verification in your application.
Create named refresh sessions, list active devices, and revoke one session or every session for a user. Already-issued access tokens remain valid until their expiration; refresh-session revocation controls future renewal.
Build your first session →import { SessionTether, SessionStatus } from 'session-tether';
const sessions = new SessionTether({
store, // Your SessionStore implementation
expiryTTL: 30 * 24 * 60 * 60 * 1000,
reuseGraceTTL: 30_000,
});
const token = await sessions.createSession({
userId,
sessionName: 'Chrome on macOS',
});
const result = await sessions.rotateRefreshToken(token);
if (result.status === SessionStatus.ROTATED) {
// Deliver result.refreshToken as the replacement credential.
}
// GRACE returns no replacement; preserve the successful rotation's token.
await sessions.revokeAllSessionsForUser(userId);Current implementation
SessionTether is experimental. SQL rotation commits consumption and replacement together and synchronizes with family revocation. Expiration is rechecked while holding the family lock. Read the implementation status and concurrency boundaries before integrating.