Session tokens and the Green Dot API

Every request to the internal Green Dot API (the endpoints that back your cabinet, your board, your friends list) carries the gd_session cookie. This document explains its structure and lifecycle.

Token format

Compact JWT, ES256-signed by our short-lived signing key, three claims: sub (opaque account identifier, not your email), iat (issued-at, seconds), exp (expiry, absolute, ninety days from iat). No other claim. No refresh token — session extension is server-side, driven by activity.

Rotation and revocation

The signing key rotates every seven days. Old tokens remain valid until exp because the previous public keys stay in the JWKS. Any explicit sign-out or "sign out everywhere" adds the token identifier to a small in-memory revocation set, checked before every API call.

Why no long-lived opaque session id?

Because a stateless signed token is cheaper to verify at the edge and cannot be spoofed even if a read-only replica of our database were leaked. The trade-off (harder to invalidate on the fly) is bounded by the seven-day rotation.