Secure QR Token Authentication
Budget: €250 – €750 EUR
I’m overhauling the sign-in flow for my private messaging product and need an engineer who can implement a rock-solid, token-based authentication system. The goal is simple: on the web client a user scans a QR code from the mobile app, receives a short-lived access token plus refresh token, and stays logged in until they choose to unlink that browser.
Scope of work
• Build the complete QR-code handshake between the mobile app (already in React Native) and the web client (React + Node).
• Issue, sign, and validate JWTs with advanced security: asymmetric keys, rotating refresh tokens, strict audience / issuer claims, TLS everywhere.
• Automatic, silent refresh of access tokens before expiry without interrupting the user.
• Server-side endpoint to terminate a specific session and immediately revoke its tokens.
• Device-management screen inside the mobile app where the user sees all linked web sessions and can remove any of them in real time.
Acceptance criteria
– Scanning the QR logs the user in on the web within two seconds.
– Access tokens expire in ≤15 min; refresh tokens rotate and are single-use.
– Revoked tokens are rejected on the very next request.
– All logic covered by unit tests; integration tests verify end-to-end flows.
– Clean, well-documented code that I can drop into an existing Express/Koa backend.
If you have deep experience with JWT, OAuth 2.0, and secure session management, I’d love to see how you would approach this and how quickly you can deliver.
Scope of work
• Build the complete QR-code handshake between the mobile app (already in React Native) and the web client (React + Node).
• Issue, sign, and validate JWTs with advanced security: asymmetric keys, rotating refresh tokens, strict audience / issuer claims, TLS everywhere.
• Automatic, silent refresh of access tokens before expiry without interrupting the user.
• Server-side endpoint to terminate a specific session and immediately revoke its tokens.
• Device-management screen inside the mobile app where the user sees all linked web sessions and can remove any of them in real time.
Acceptance criteria
– Scanning the QR logs the user in on the web within two seconds.
– Access tokens expire in ≤15 min; refresh tokens rotate and are single-use.
– Revoked tokens are rejected on the very next request.
– All logic covered by unit tests; integration tests verify end-to-end flows.
– Clean, well-documented code that I can drop into an existing Express/Koa backend.
If you have deep experience with JWT, OAuth 2.0, and secure session management, I’d love to see how you would approach this and how quickly you can deliver.