Every JWT auth system I've ever seen uses expiries on the order of minutes, and using a single-use refresh token to allow the client application to invisibly re

Every JWT auth system I've ever seen uses expiries on the order of minutes, and using a single-use refresh token to allow the client application to invisibly request an updated token.