+
+ 
+
+
+
+ Forge Your Auth. Own Every Token. +
+ +
+ 
+ 
+ 
+ 
+ 
Name: ${name}
`, + `Email Address: ${email}
`, + `Message:
`, + `
+
+ + Active sessions represent current valid user refresh token chains stored inside the + Redis database. Revoking a user's sessions immediately invalidates their refresh token + chain and prevents silent token rotations, forcing them to re-authenticate on next + request. +
+| Event | +User ID | +IP | +Time | +
|---|---|---|---|
|
+ |
+ {log.userId || 'Guest'} | +{log.ip} | ++ {new Date(log.createdAt).toLocaleString()} + | +
| + No logs found. + | +
+ Authorized with {r.permissions.length} security permissions. +
++ The following cryptographic permission claims are attached to user sessions holding + this role: +
+ +| Name | +Role | + {canDeleteSessions &&Actions | } +|
|---|---|---|---|
| {u.name} | +{u.email} | ++ + | + {canDeleteSessions && ( ++ + | + )} +
| + No users found. + | +
+ Insufficient permissions to view system-wide logs. Admin or Moderator privileges are + required. +
+
+ {payload ? JSON.stringify(payload, null, 2) : 'No payload claims loaded'}
+
+ {panelDescription}
++ TokenForge is operating normally. All security enforcement policies, PKCE + configurations, and rate-limiting modules are active. Cryptographic signatures are + signing via standard RS256 algorithms. +
++ Inspect your current active session state, JWT claims, and security logs. +
+
+ + Custom authentication without Auth0. An open-source, developer-first boilerplate with + RS256 asymmetric signing, OAuth2 Google/GitHub, and custom RBAC — forged from scratch. +
+ ++ RS256 · httpOnly cookies · Token family tracking +
++ Auth0, Clerk, Firebase Auth — all abstract the token layer. You sign up, paste an SDK + key, and trust someone else's security model. At 10k users, you get hit with a massive + monthly bill. +
++ You can't audit how tokens are signed. You can't see rotation logic. Your RBAC is + locked to their dashboard schema. When their service has downtime — your users can't + log in. +
++ RS256 JWT + Refresh Rotation + OAuth2 PKCE + RBAC. Every line is yours. Every token is + yours. Every decision is yours. Free to deploy. Free to audit. Free forever. +
+{item.desc}
+{step}
+
+ {'async '}
+ generateTokenPair
+ {'(payload: '}
+ JwtPayload
+ {'): '}
+ Promise
+ {'<{'}
+ {'\n '}
+ {'accessToken: '}
+ string
+ {';'}
+ {'\n '}
+ {'refreshToken: '}
+ string
+ {';'}
+ {'\n'}
+ {'}> {'}
+ {'\n '}
+ const
+ {' jti = '}
+ uuid
+ {'();'}
+ {'\n '}
+ const
+ {' accessToken = '}
+ jwt.sign
+ {'(payload, privateKey, {'}
+ {'\n '}
+ {'algorithm: '}
+ 'RS256'
+ {', jti,'}
+ {'\n '}
+ {'});'}
+ {'\n '}
+ const
+ {' refreshToken = '}
+ this
+ {'.'}
+ saveToRedis
+ {'(payload.userId, jti);'}
+ {'\n '}
+ return
+ {' { accessToken, refreshToken };'}
+ {'\n'}
+ {'}'}
+
+ + Stateless API tier scaling alongside memory-mapped cache boundaries. +
++ Dive into the dashboard console to inspect decoded token claims, trigger rotation, or + audit security events. +
+ + + ++ At TokenForge, we respect your cryptographic identity privacy. We only process + session data, authorization parameters, and audit logging metrics explicitly + generated to safeguard account actions. +
++ We store authentication credentials securely using cryptographic hashing standards + (bcrypt) and asymmetrical encryption signatures (RS256). We never sell your + personal information. +
++ By accessing TokenForge, you agree to protect the security of your private keys + and credentials. Unauthorized exploitation, credential sharing, or token + manipulation is strictly prohibited. +
++ All software is provided "as is", without warranty of any kind, express or + implied. +
+