I write my own. Though my platforms do not socially integrate. I tend to use one API endpoint for pass phrase authentication, which returns a token (any suffic

I write my own. Though my platforms do not socially integrate. I tend to use one API endpoint for pass phrase authentication, which returns a token (any sufficiently complex unique string, such as base64 (or hex) of a >128 bit unique key . Many auths use a hash, to which I say don’t get carried away) The token is a temporary throw away credential that should: * expire (say 8 hours) * times out after inactivity (say 2 hours) * unique to session (allows distinction among concurrent sessions). I hash the token to create a unique session ID for logging I only store these in cache, not the db so they expire and cannot be recovered (hashed again to create a trackable unique value.)