Sessions and Tokens - SEND Docs

Access and Refresh Tokens

Signing in returns two tokens rather than a session cookie. Both are JWTs signed by the server, and both carry a fixed lifetime that is set at issue time.

Expiry is absolute per token. There is no inactivity timer that extends a token because you are still clicking, and no timer that ends it early because you stepped away.

Access token: valid for 30 minutes, sent on every request as an Authorization: Bearer header
Refresh token: valid for 30 days, used only to obtain a new access token
The sign-in response reports the access-token lifetime as 1800 seconds
Both lifetimes are fixed in the build -- there is no per-account or per-device setting

Automatic Renewal

You do not normally notice the 30-minute expiry. When a request comes back 401, the client refreshes once and replays the original request.

Several requests failing at once queue behind a single refresh instead of each firing their own
Every refresh issues a new refresh token, so a session in continuous use rolls forward indefinitely
If the refresh itself fails, both tokens are cleared and you are returned to the sign-in page
An account left untouched stops working 30 days after its most recently issued refresh token

Every Request Is Re-Checked

A valid signature alone is not sufficient. On each authenticated request the server loads the account and rejects the token if the account is inactive, or if the version recorded in the token no longer matches the account.

A deactivated account therefore stops working on its very next request. Nothing waits for the token to expire.

Signing Out of Every Device

There is exactly one mechanism that invalidates tokens that have already been issued, and it is changing your password. Doing so advances the account's session version, which immediately invalidates every access and refresh token ever issued for the account, on every device.

There is no self-service password reset. The change-password form is the only password operation, and it requires your current password.

Changing your password is the sign-out-everywhere action. If you suspect your account is compromised, change the password -- then revoke your API keys separately, because API keys are not tied to the session version and keep working.

Settings > Security > Change Password takes your current password and a new one that meets the same strength rules as registration
The new password must differ from the current one
On success the browser you changed it in is signed out too and sent back to the sign-in page -- the old tokens die the moment the version advances
Open WebSocket connections close at the next revalidation pass, within 5 minutes

What Logging Out Does

Logging out clears both tokens and the cached profile from your browser. It does not revoke them on the server: there is no token blacklist, so a token copied off the device before you logged out remains valid until it expires on its own.

On a shared or untrusted computer, logging out is not enough. Change your password afterwards -- that is what actually invalidates the tokens that machine saw.

Where Tokens Live

The browser keeps both tokens in local storage rather than in HTTP-only cookies, which has a few practical consequences worth knowing.

Tokens survive closing a tab and restarting the browser, until they expire
They are shared across tabs in the same browser profile, not scoped to one tab
Clearing site data for send.meme signs you out on that browser
They are readable by JavaScript running on the page, which is why you should never paste scripts from third parties into the browser console