Short-lived access, long-lived refresh
Access tokens expire quickly and refresh tokens rotate, so a leaked token is only useful for minutes.
Work / Secure notes API + web app
NexusNotes
A notes product on a stateless, secure API, built twice: once in Kotlin with Spring Boot and once in Python with FastAPI.
Web appREST API2025
The challenge
Authentication is where most apps leak. The goal was an API where tokens expire, refresh safely and never expose passwords.
What was built
- JWT access and refresh tokens, bcrypt-hashed passwords
- Notes API on MongoDB with a React front end
- The same API rebuilt in FastAPI with background jobs
Engineering decisions
The parts that make it hold up in real use
Stack
KotlinSpring BootSpring SecurityMongoDBReactFastAPI
Need a product built this carefully?
Share a few details and you'll get a reply within 24 hours: honest advice, a rough range, and the next step.