Modern client applications—including mobile apps built with Flutter and single-page web dashboards—communicate with backend infrastructure entirely via RESTful APIs. Because APIs are public-facing endpoints exposed to the open internet, traditional session-cookie authentication is insufficient.
Securing sensitive business endpoints requires a robust token architecture combined with cryptographic request signing.
The Short-Lived JWT & Rotating Refresh Token Pattern
Stateless JSON Web Tokens (JWTs) are fast to verify without database lookups. However, if a JWT has a 30-day expiration and is intercepted via a compromised device, the attacker retains full access for a month with no server-side revocation mechanism.
The enterprise solution is the Two-Token Architecture:
+--------------------------------------------------------------+
| Rotating Refresh Token Flow |
| |
| [Client] ---> POST /api/token/refresh (with Refresh Token) |
| | |
| v |
| [API Server] Verifies Refresh Token in DB |
| - If valid: |
| 1. Invalidate old Refresh Token |
| 2. Issue new Access Token (15 min) |
| 3. Issue new single-use Refresh Token |
| - If token was already used (Replay Attack Detected): |
| Revoke all tokens associated with this user session! |
+--------------------------------------------------------------+Cryptographic HMAC Request Signatures for Sensitive Operations
For high-value financial transactions (such as initiating payouts or balance transfers in ClearBalance), token authorization alone is not enough. The client must sign the request payload using an HMAC-SHA256 signature combining:
Signature = HMAC-SHA256(SecretKey, Method + URI + Timestamp + Nonce + BodyHash)If an attacker intercepts the packet in transit and attempts to alter the transfer amount, the signature check fails immediately and triggers an immediate security alert.