Appreciate the response. I'm using bcrypt simply because it's what I was using before we moved to UUIDs and this truncation issue was introduced; it's not a re

Appreciate the response. I'm using bcrypt simply because it's what I was using before we moved to UUIDs and this truncation issue was introduced; it's not a requirement. I did think about simply ignoring the UUIDs when hashing, and append it before sending it back to the client. I may revisit that. The reason I'm not doing a lookup for the token itself (skipping the account) is because we're using postgres schemas, so I need to switch to the correct account before querying for the token. Good points about tokens already containing salt, as well as prefixing the tokens with a version. I'll keep that in mind. And yes, the token expiry's are handled on the token model itself.