Devlog — Authentication System v2

Built a Production-Ready Authentication Flow

Athenaeum’s authentication system is now significantly more complete.

Implemented a complete access + refresh token architecture with:

• JWT-based access tokens for authenticated API requests
• Long-lived refresh tokens for maintaining user sessions
• Secure refresh-token hashing before storing tokens in PostgreSQL
• Token expiration to invalidate stale refresh tokens
• Refresh-token rotation on every successful refresh
• Token revocation to invalidate previously used refresh tokens
• PostgreSQL-backed refresh-token persistence using SQLAlchemy
• Alembic migrations for database schema management
• OAuth2-compatible authentication integrated with FastAPI Swagger
• Protected API routes using JWT-based dependency injection