Security & Session Management

Your account security is our top priority. We use bcrypt hashing, JSON Web Tokens (JWT), and server-side blacklisting to block unauthorized access.

Feature Breakdown

FT-AUTH-001

Secure email registration and login architecture, protected by strict password policies and automated account lockouts.

Technical Capabilities:

Enforces strong passwords (minimum 8 characters with at least one number).

Locks out accounts for 15 minutes after 5 consecutive failed login attempts.

Prevents account scanning by using generic login failure messages.

Prevents duplicate email registration natively at database level.

FT-AUTH-002

Allows users to recover access securely through time-restricted tokens sent via premium transactional delivery partners.

Technical Capabilities:

Generates cryptographic reset tokens that expire after exactly 30 minutes.

Sends reset links through transactional servers (Postmark/SendGrid) for speed.

Requires dual-confirmation of the new password to prevent input typos.

Immediately invalidates previous active sessions on password change.

FT-AUTH-003

Validates all API queries via secure JSON Web Tokens and supports server-side session termination on logout.

Technical Capabilities:

Signs JWTs with a 24-hour expiration key to secure user sessions.

Saves logged-out tokens to a Redis blacklist database with matching TTL.

Filters all protected routing paths (/api/v1/*) through JWT validation.

Returns standard 401 Unauthorized status for expired or blacklisted tokens.

Password Cryptographybcrypt (10+ Salt Rounds)

Token SecurityHMAC SHA-256 JWT

Lockout DatabaseRedis Key-Value Cache

Transactional SMTPPostmark / SendGrid Relay

See exactly how this module manages background queues, encryption, and delivery logic in our sequence flowchart.

Scale your deliverability with our intelligent sharding relay. Add your domains and start landing in the inbox.