# Redis Keys

This page lists every key the package writes to Redis, with TTLs and write timing, for monitoring and debugging.

## Key List

| Key | Value | TTL |
|---|---|---|
| `refresh:<refresh_id>` | `RefreshData` JSON | `refreshTokenExpires` |
| `revoke:<access_token>` | `"1"` | `accessTokenExpires` |

## Write Timing

| Operation | Key | TTL |
|---|---|---|
| `CreateJWT()` | `refresh:<id>`, `version: 1` | `refreshTokenExpires` |
| Refresh (no rotation) | `refresh:<id>`, `version + 1` | Reset to `refreshTokenExpires` |
| Refresh (rotation) | Old `refresh:<id>` | 5 seconds |
| Refresh (rotation) | New `refresh:<id>`, `version: 0` | `refreshTokenExpires` |
| `RevokeJWT()` | `refresh:<id>` | 5 seconds |
| `RevokeJWT()` | `revoke:<access_token>` | `accessTokenExpires` |

## Debugging Commands

```bash
# List all sessions
redis-cli --scan --pattern 'refresh:*'

# Inspect a Refresh ID and its remaining seconds
redis-cli GET 'refresh:<refresh_id>'
redis-cli TTL 'refresh:<refresh_id>'

# Force a session to end
redis-cli DEL 'refresh:<refresh_id>'
```

After deleting `refresh:<id>`, the session can no longer refresh once its Access Token expires; an unexpired Access Token still passes verification until it expires.

## Capacity

`revoke:` keys are named after the full Access Token, so each entry is roughly the token length (a few hundred bytes); under heavy logout volume, `accessTokenExpires` bounds how long they are kept.

Related: [Refresh Token Rotation](/token-refresh), [Token Revocation](/token-revocation)