I’m building an API first product and need secure user sessions, what do you recommend?

For an API-first product, the safest default is usually:

Use short-lived access tokens + refresh tokens, backed by server-side session state or token revocation.
If you also have a browser frontend, store tokens in secure, HttpOnly cookies rather than localStorage.

Recommended approach

1) Access token

• Short lifetime: 5–15 minutes
• Used to authenticate API requests
• Signed JWT or opaque token both work
• Keep the scope narrow

2) Refresh token

• Longer lifetime: days to weeks
• Used only to get a new access token
• Rotate on every use
• Revoke on logout, password change, suspicious activity, etc.

3) Storage

For web apps:

• HttpOnly
• Secure
• SameSite=Lax or Strict if possible
• Prefer cookies over localStorage to reduce XSS risk

For mobile / desktop apps:

• Store in the OS secure storage:
  • iOS Keychain
  • Android Keystore / EncryptedSharedPreferences
  • macOS Keychain, Windows Credential Manager, etc.

4) Session backend

Even if you use JWTs, it helps to keep server-side controls:

• session table or token registry
• refresh token rotation tracking
• revocation list or token family tracking
• device/session metadata

This gives you:

• logout everywhere
• compromised token invalidation
• anomaly detection
• device-level session management

If you want the most secure and modern setup

Consider:

• OAuth 2.1 + OpenID Connect if you need third-party login or SSO
• PKCE for public clients
• BFF pattern (Backend for Frontend) for browser apps, where the browser only talks to your backend, and the backend holds tokens

BFF is especially strong because:

• tokens never touch the browser JS runtime
• reduces XSS token theft risk
• simplifies cookie-based auth

What I’d avoid

• Long-lived JWTs with no revocation
• Storing tokens in localStorage
• Session IDs in URLs
• Rolling your own crypto/auth protocol
• Using cookies without CSRF protections if your app is cross-site or not SameSite-protected

Practical default recommendation

If you’re starting today:

• Browser app: session cookie or BFF with HttpOnly Secure SameSite cookies
• API auth: short-lived access token + rotating refresh token
• Server-side session tracking: yes
• MFA for sensitive accounts: yes
• Device/session management UI: yes

Rule of thumb

• If your frontend is a browser app: cookies + BFF
• If your frontend is mobile/native: OAuth/OIDC-style tokens + secure OS storage
• If you need both: design around refresh token rotation and revocation

If you want, I can sketch a reference architecture for your stack (e.g. Node, Rails, Go, Django, Next.js, mobile) and show the exact login/refresh/logout flow.