Treat expiry as a product decision
Short-lived access tokens reduce exposure, but only when the refresh path is deliberate. Decide which sessions can be renewed, when re-authentication is required, and what happens after a password or role change.
Keep authorisation on the server
A hidden navigation item is not access control. Every protected endpoint should verify identity and permission server-side before it returns data or changes state.
Do not put sensitive claims in the token
A signed token is readable by its holder. Keep claims small: identity, role and a short expiry. Fetch changing permissions from a trusted data source when the request needs them.
Plan for revocation before launch
Subscriptions, account suspension and password changes all create moments when yesterday’s access token must stop working. A versioned session or revocation check keeps those cases predictable.
Make the secure path easy to use
The safest design is one the frontend can follow consistently: clear API contracts, explicit error states, httpOnly cookies where appropriate, and no one-off exceptions.