# JWT Authentication | EternalEngine Security

Secure sessions, zero compromise. RS256-signed JWT tokens, automatic key rotation, configurable expiry, and tamper-proof session management — built in.

Security & Compliance

# Secure sessions, zero compromise.

EternalEngine uses RS256-signed JWT tokens for stateless, scalable authentication. Tokens are cryptographically verified on every request. Keys rotate automatically. Sessions expire on your schedule.

[Start free](https://app.eternalengineos.io/signup?plan=free&interval=annual)[View all security →](https://eternalengineos.io/features/security-compliance/)

JWT Auth Flow

1

User Login

Email + password → bcrypt verify → auth context set

POST /auth/login

2

JWT Issued

RS256 signed · tenant_id claim · 1h expiry

access + refresh

3

Token Validation

Signature check → expiry check → tenant context inject

✓ every request

↻

Automatic Key Rotation

RSA keypair rotated on schedule · zero downtime

scheduled

✓ RS256 signature — tamper-proof by design · cannot be forged without private key

## Authentication designed to scale

Stateless, verifiable, and secure — from your first user to your ten-thousandth.

### RS256-Signed Tokens

Tokens are signed with an RSA private key and verified with the public key. Asymmetric signing means even a compromised microservice cannot forge tokens — only the auth service holds the private key.

### Automatic Key Rotation

RSA keypairs rotate on a defined schedule. Old keys are retained briefly for in-flight token validation, then retired. No manual key management. No rotation downtime.

### Configurable Expiry

Access tokens expire after a short window (configurable, default 1 hour). Refresh tokens extend sessions without re-login. Short access token lifetimes limit blast radius of any token leakage.

### Refresh Token Policies

Refresh tokens are stored hashed, single-use (rotated on each use), and bound to a device fingerprint. Suspicious refresh attempts trigger an immediate session revocation and alert.

## Stateless. Scalable. Secure.

JWT authentication means no session state to manage, no single point of failure, and no shared secret to protect.

### Stateless Security

No server-side session store means no shared state to attack. Each token is self-contained and cryptographically verifiable. Scale horizontally without any session synchronization overhead.

### Scalable Auth

Token verification is a pure cryptographic operation — fast, parallel, and requiring no database lookup per request. Auth adds microseconds, not seconds, to your request latency.

### Tamper-Proof Sessions

Any modification to a JWT payload invalidates the RS256 signature immediately. A tampered token is rejected before it touches any business logic — no injection, no privilege escalation.

Questions

## Common questions, straight answers.

### Keep exploring

- [All security features](https://eternalengineos.io/features/security-compliance/)
- [API security](https://eternalengineos.io/features/security-compliance/api-security/)
- [Role-based access](https://eternalengineos.io/features/security-compliance/role-based-access/)
- [Plans and pricingFree to start; every paid plan has a 30-day free trial.](https://eternalengineos.io/pricing/)

How are sessions secured?

Sign-in issues a signed JWT with an expiry; every request is verified for signature and expiry and the tenant is taken from the token, never from the request.

Is MFA available?

Yes. Two-factor authentication can be enabled per user, and administrators can require it.

Do you support single sign-on?

SSO / SAML is included on Business and Enterprise.

## Run your business from one place.

Five plans, seventeen launch apps, one dashboard. Set up in under 5 minutes — change tiers any time.

[Start free$0 forever • No card • Upgrade any time](https://app.eternalengineos.io/signup?plan=free&interval=annual)[Talk to Sales](https://eternalengineos.io/contact/)

From $0 · Basic $9.95/mo · Save 20% on annual billing · Upgrade or downgrade any time