# `Sake.Auth.TokenRecord`
[🔗](https://github.com/hattoriai/sake/blob/v0.4.3/lib/sake/auth/records.ex#L55)

An access or refresh token (stored hashed). `family_id` groups the
tokens born from one authorization code. `jkt` is the RFC 7638
thumbprint of the DPoP key the token is bound to (its `cnf.jkt`), or nil
for a bearer token. `acr` and `auth_time` are how and when the person
signed in to approve the grant (RFC 9470), or nil when unknown (and
always for a machine client); a refresh keeps them, since it is no new
sign-in.

A token from an external authorization server (see
`Sake.Auth.External`) is never stored: its record is made for each
request, with that server's `issuer` and the verified `claims` (the
JWT's, the introspection answer, or what your callback returned). Both
are nil for a token of `Sake.Auth`.

# `t`

```elixir
@type t() :: %Sake.Auth.TokenRecord{
  acr: term(),
  auth_time: term(),
  claims: term(),
  client_id: term(),
  expires_at: term(),
  family_id: term(),
  hash: term(),
  id: term(),
  inserted_at: term(),
  issuer: term(),
  jkt: term(),
  kind: term(),
  resource: term(),
  revoked_at: term(),
  scopes: term(),
  subject_id: term(),
  used_at: term()
}
```

---

*Consult [api-reference.md](api-reference.md) for complete listing*