jwt token and refresh token expire time is determined via env var

app/auth/jwt.py

@@ -6,6 +6,9 @@ from fastapi import HTTPException, status
 JWT_SECRET = os.getenv("JWT_SECRET")
 JWT_ALGORITHM = os.getenv("JWT_ALGORITHM", "HS256")
 
+ACCESS_TOKEN_EXPIRE_MINUTES = int(os.getenv("ACCESS_TOKEN_EXPIRE_MINUTES", "60"))
+REFRESH_TOKEN_EXPIRE_DAYS = int(os.getenv("REFRESH_TOKEN_EXPIRE_DAYS", "7"))
+
 def now():
     return datetime.now(timezone.utc)
 
@@ -13,7 +16,7 @@ def create_access_token(data: dict):
     payload = {
         **data,
         "type": "access",
-        "exp": now() + timedelta(minutes=60),
+        "exp": now() + timedelta(minutes=ACCESS_TOKEN_EXPIRE_MINUTES),
         "iat": now(),
     }
     return jwt.encode(payload, JWT_SECRET, algorithm=JWT_ALGORITHM)
@@ -22,7 +25,7 @@ def create_refresh_token(data: dict):
     payload = {
         **data,
         "type": "refresh",
-        "exp": now() + timedelta(days=7),
+        "exp": now() + timedelta(days=REFRESH_TOKEN_EXPIRE_DAYS),
         "iat": now(),
     }
     return jwt.encode(payload, JWT_SECRET, algorithm=JWT_ALGORITHM)