Turnkey Auth • Stateless Sessions
Turnkey User Sessions & JWTs.
Stop writing custom token tables and session logic. Pass verified OTPs to FlashAuth to automatically issue signed JWT access tokens and rotating refresh tokens.
Signed HS256 JWTs
Cryptographically signed short-lived access tokens (15m TTL) allow your backend or edge middleware to verify requests statelessly.
Sliding Refresh Tokens
30-day sliding refresh tokens allow users to remain securely signed in across browser sessions without re-authenticating repeatedly.
Automatic User Provisioning
First-time phone numbers automatically create a unique usr_... profile. Returning numbers log in seamlessly.
auth-flow.ts
POST /v1/auth/login1234567891011121314151617181920// 1. Exchange verified OTP code for JWT sessionconst authRes = await fetch(process.env.FLASHAUTH_API_URL + "/v1/auth/login", { method: "POST", headers: { "Content-Type": "application/json", "x-api-key": process.env.FLASHAUTH_API_KEY!, }, body: JSON.stringify({ verification_id: "9b1deb4d-3b7d-4bad-9bdd-2b0d7b3dcb6d", }),}); const { user, access_token, refresh_token } = await authRes.json(); // 2. Response payload contains user object + signed tokens// {// "user": { "id": "usr_9b1deb4d", "phone": "+155523xxxxx" },// "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...", // 15m TTL// "refresh_token": "rf_9b1deb4d7b3dcb6d..." // 30d sliding// }Explore More Features
Discover test mode sandbox and automatic rate limits.