Auth & Tokens
Create the async core instance, then issue or verify access and refresh tokens.
Refresh Flow
Access tokens expire quickly. Refresh tokens rotate automatically and are stored in Redis to prevent replay attacks.
Middleware
Protect routes with role-based access, rate limiting, IP filtering, and security headers.
Guest Access
Issue anonymous tokens for unauthenticated users without requiring sign-up.
OAuth & Identity
Normalize Google and GitHub profiles, resolve identities, and securely link providers.
Redis
Redis backs refresh tokens, rotation locks, OAuth state, rate limiting, identity records, and session control.