A refresh-token profile: long-lived and pinned to typ: "rt+jwt". Give it
the auth server as its audience, never the API; nothing here can check
that for you, because the profile has never seen your API's audience. Pass a revocation store -
a long-lived token you cannot revoke is a long-lived incident.
A refresh-token profile: long-lived and pinned to
typ: "rt+jwt". Give it the auth server as its audience, never the API; nothing here can check that for you, because the profile has never seen your API's audience. Pass arevocationstore - a long-lived token you cannot revoke is a long-lived incident.