Skip to content

Authentication Configuration Guide

Token Settings

The producer portal expects the following token configuration from the backend API:

Access Token

  • Expiration Time: 24 hours (86400 seconds)
  • Token Type: JWT
  • Refresh Buffer: 5 minutes (tokens are refreshed 5 minutes before expiry)

Refresh Token

  • Endpoint: /auth/token/refresh/
  • Method: POST
  • Request Body: { "refresh": "<refresh_token>" }
  • Response: { "access": "<new_access_token>" }

Important Backend Considerations

  1. Token Expiration Mismatch: If your backend uses a different token expiration time than 24 hours, update the following file: 

    src/config/auth.ts
    Change TOKEN_EXPIRATION_MS to match your backend setting (in milliseconds).

  2. Error Response Format: When token refresh fails, ensure the backend returns appropriate HTTP status codes:

  3. 401 for invalid/expired refresh tokens
  4. 403 for revoked/blacklisted tokens

  5. Include error details in the response body

  6. CORS Configuration: Ensure the backend allows credentials from the frontend domain for token refresh requests.

Debugging Authentication Issues

  1. Enable debug mode by setting NODE_ENV=development to see detailed auth logs in the browser console.

  2. Check the browser console for messages starting with [Auth] to track token refresh attempts.

  3. Common issues:

  4. Backend token expiration shorter than frontend expects
  5. Refresh token endpoint returning unexpected response format
  6. CORS blocking token refresh requests
  7. Clock skew between client and server

Session Behavior

  • Sessions are checked and refreshed automatically by NextAuth
  • Tokens are refreshed 5 minutes before expiration to prevent race conditions
  • Only true authentication failures (invalid tokens) trigger logout
  • Authorization errors (403) show error messages but don't log out users

API Error Handling

The frontend distinguishes between: - Authentication errors (401 with token-related messages) → Logout - Authorization errors (403, 401 without token issues) → Show error, stay logged in - Network/Server errors → Retry automatically, show error if persistent