Replace Server Sessions With Stateless Tokens

Every API request looks up its session in a Redis cluster shared by the web app and the mobile apps. The store serves 90,000 reads per second at peak, and its two outages this year signed out every user and blocked new sign-ins for 47 minutes in total.

At sign-in, the auth service issues a JWT signed with HS256. Each of the 60 backend services receives the same signing secret and verifies tokens locally, so no request touches the session store.

Services verify tokens with whichever JWT library their language team already uses, and each library reads the signing algorithm from the token's header.

Roles and organization membership travel in the token, so services make permission checks without calling the permissions service.

To save a lookup on every page, tokens also include the user's email address and display name.

Tokens are valid for 30 days, matching today's session length, and there is no server-side revocation: sign-out deletes the token from the client.

The web app stores the token in localStorage and attaches it to each request in the Authorization header. The mobile apps keep it in the platform keychain.

On launch day, all existing sessions are deleted, and every user signs in again to receive a token.

Session store traffic drops to zero, sign-in availability stays above 99.95% through the quarter, and the Redis cluster is shut down at the end of it.