# Spec

Issue short-lived signed tokens (JWT, 15-minute TTL) with refresh rotation.

- In scope: token mint, verify, refresh.
- Out of scope: the session-management UI.