Secure by design

JWT auth with refresh token rotation, multi-device session management and 2FA support.