Overview
Use short-lived access tokens, refresh-token records, device sessions, introspection, revocation, idle/expiry policy, and administrator forced logout.
Problem
Authentication must remain controllable after the initial password check.
Solution
Keep session and refresh state in AccessGuard and evaluate active/revoked/expired/account policy before continuing a session.
How it works
AccessGuard issues tokens through the canonical authentication surface, tracks device sessions and refresh records, exposes introspection, and supports user/admin revocation and background token pruning.
Who is this for
Security Administrator
Application Engineer
Expected outcomes
- Consistent session state across connected applications
- Immediate administrative session revocation and lifecycle pruning
Key metrics
Security impact
- User ID, device/session metadata, refresh records, token revocation and login events · PII: yes for identity, IP/device and event metadata
Compliance
- Session permissions, protected JWT signing secret, revocation state, and audit logging
Availability & next steps
Starter
Pro
Enterprise