A RefreshToken is the server-side record of one active sign-in session. Rather than store the raw token, the platform keeps a tokenHash and groups related tokens with a family value so a stolen-and-reused token can be detected and the whole family revoked. Each record links to its userId and tenantId, notes the authMethod used to sign in, and captures ipAddress and userAgent for an audit trail. Lifecycle fields isRevoked, expiresAt, and revokedAt control when the session ends, and impersonatedBy marks sessions an operator opened on a user's behalf during support.
Technical section
Data model, API, and internals — visible to developers.