An access or refresh token (stored hashed). family_id groups the
tokens born from one authorization code. jkt is the RFC 7638
thumbprint of the DPoP key the token is bound to (its cnf.jkt), or nil
for a bearer token. acr and auth_time are how and when the person
signed in to approve the grant (RFC 9470), or nil when unknown (and
always for a machine client); a refresh keeps them, since it is no new
sign-in.
A token from an external authorization server (see
Sake.Auth.External) is never stored: its record is made for each
request, with that server's issuer and the verified claims (the
JWT's, the introspection answer, or what your callback returned). Both
are nil for a token of Sake.Auth.
Summary
Types
@type t() :: %Sake.Auth.TokenRecord{ acr: term(), auth_time: term(), claims: term(), client_id: term(), expires_at: term(), family_id: term(), hash: term(), id: term(), inserted_at: term(), issuer: term(), jkt: term(), kind: term(), resource: term(), revoked_at: term(), scopes: term(), subject_id: term(), used_at: term() }