Configuration

Customize authentication settings per project.

Settings

Token Lifetimes:

access_token_lifetime - How long access tokens last
refresh_token_lifetime - How long refresh tokens last
refresh_token_reuse_interval - Token reuse window

Session Management:

inactivity_timeout - Force re-login after inactivity
max_session_duration - Force re-login after duration

Password Requirements:

min_password_length - Minimum characters
require_uppercase - Require A-Z
require_lowercase - Require a-z
require_numbers - Require 0-9
require_special_chars - Require !@#$%
max_password_history - Prevent password reuse

Rate Limiting:

rate_limit_signup - Signups per hour per IP
rate_limit_signin - Signins per hour per IP
rate_limit_token_refresh - Refreshes per hour per IP

CORS:

cors_enabled - Enable origin validation
cors_allowed_origins - Whitelist domains

Access Control:

Get Configuration

curl https://api.volcano.dev/projects/PROJECT_ID/auth/config \
  -H "Authorization: Bearer PLATFORM_TOKEN"

Update Configuration

curl -X PUT https://api.volcano.dev/projects/PROJECT_ID/auth/config \
  -H "Authorization: Bearer PLATFORM_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "access_token_lifetime": 7200,
    "min_password_length": 20,
    "require_numbers": true,
    "cors_enabled": true,
    "cors_allowed_origins": ["https://myapp.com"]
  }'

Common Configurations

High Security (Banking):

{
  "access_token_lifetime": 900,
  "inactivity_timeout": 300,
  "min_password_length": 20,
  "require_uppercase": true,
  "require_lowercase": true,
  "require_numbers": true,
  "require_special_chars": true
}

Balanced (SaaS):

{
  "access_token_lifetime": 3600,
  "min_password_length": 15
}

Low Friction (Social App):

{
  "access_token_lifetime": 7200,
  "refresh_token_lifetime": 7776000,
  "min_password_length": 15
}

See Individual Settings

Each setting has its own documentation page with:

What it does
When to use it
Examples
Tradeoffs

Click the links above for detailed guides.