Authentication System
OTP-first authentication with dual JWT cookies and transparent refresh
Authentication Method
OTP Authentication Flow
Enter Email/Phone
User enters identifier
Send OTP
System sends 6-digit code
Verify OTP
User enters code
Issue Tokens
Dual JWT cookies set
Access Granted
User redirected to app
Enter Email/Phone
// Check if user exists
POST /api/v1/auth/send-otp
{ identifier: "user@example.com", flow: "signin" }Dual Cookie JWT System
VCN-Cookie (Main Auth)
| Duration: | 14 days |
| Content: | Full JWT |
| Purpose: | API Auth |
| HttpOnly: | ✅Yes |
| Secure: | ✅Yes |
CDN-Cookie (Refresh Trigger)
| Duration: | 10 minutes |
| Content: | HMAC Token |
| Purpose: | CDN Access |
| Path: | /api, /ui, /mi |
| Auto-refresh: | ✅Yes |
Transparent Token Refresh
CDN Cookie Expires
After 10 minutes
CDN cookie expires, triggering refresh
Nginx Intercept
Automatic redirect
Nginx detects missing CDN cookie, redirects to /refresh
Validate Main Token
VCN token still valid
Main 14-day token validates user identity
Issue New CDN Token
New 10-min token
Fresh CDN cookie issued, user continues seamlessly
User never sees login screen during 14-day period - completely frictionless!
Security Features
HttpOnly Cookies
Prevents XSS attacks - JS cannot access tokens
CSRF Protection
Double-submit cookie pattern for security
Short-lived Tokens
10-min CDN tokens limit exposure window
Secure Flag
HTTPS-only transmission of cookies
Rate Limiting
Prevents brute force OTP attempts
Redis Storage
OTPs expire and are single-use only
Continue Learning
Explore more framework features