Token Management Policy
Last updated: April 5, 2026
This policy describes how M&R Edge Studio (operated by Michelle & Rich Essence Ltd) manages authentication tokens, API keys, and OAuth credentials across our platform. We follow industry best practices to protect user sessions and third-party integrations.
1. Token Types & Purpose
Our platform uses the following token types:
- Session Tokens (JWT) — Issued upon user authentication to maintain login sessions. Contain user identity claims and are validated server-side on every request.
- Refresh Tokens — Long-lived tokens used to obtain new session tokens without requiring re-authentication. Stored securely and rotated on use.
- OAuth Access Tokens — Obtained from third-party platforms (TikTok, Meta/Instagram, LinkedIn, Pinterest) to publish content on behalf of the user.
- OAuth Refresh Tokens — Used to renew expired OAuth access tokens without requiring the user to re-authorise.
- API Keys — Server-side credentials for third-party service integrations (e.g., AI providers, payment processors). Never exposed to client-side code.
2. Token Lifecycle & Expiry
| Token Type | Expiry | Rotation |
|---|---|---|
| Session JWT | 1 hour | Auto-refreshed via refresh token |
| Refresh Token | 30 days | Rotated on each use (one-time use) |
| OAuth Access Token | Platform-defined (1–24 hrs) | Auto-refreshed before expiry |
| OAuth Refresh Token | Platform-defined (60–90 days) | Rotated per platform policy |
3. Secure Storage
- OAuth tokens are encrypted at rest using AES-256-GCM before being stored in our database. Plaintext tokens are never persisted.
- Session tokens are stored in secure, HttpOnly cookies or memory-only storage and are never written to localStorage.
- API keys for third-party services are stored as encrypted secrets in our backend vault and are only accessible by server-side functions.
- Client-side code never has access to any secret key, refresh token, or OAuth token. All sensitive operations are proxied through authenticated backend functions.
4. Token Revocation & Invalidation
Tokens are immediately revoked or invalidated when:
- A user logs out — all active session and refresh tokens are invalidated
- A user disconnects a social platform — the corresponding OAuth tokens are deleted from our database
- A user deletes their account — all tokens across all services are purged
- A third-party platform sends a deauthorize webhook — tokens are automatically removed
- Suspicious activity is detected — sessions may be forcibly terminated by administrators
- A password is changed — all existing sessions are invalidated
5. Token Compromise Response
In the event of a suspected token compromise:
- All affected tokens are immediately rotated or revoked
- Affected users are notified and prompted to re-authenticate
- Third-party platform tokens are revoked via their respective APIs
- The incident is logged in our audit system for investigation
- If required by law, affected users and relevant authorities are notified within 72 hours
For questions about this policy, contact security@mredgestudios.com.
© 2026 Michelle & Rich Essence Ltd. All rights reserved.