interface.
this update token may help you

increase the duration, such as 15 days

there should be two token, one is access_token, and the other is refresh_token, returned to the client at the same time, but there is a difference.
1. The expiration time is different. The access_token expiration time should be set to be shorter, such as 1 hour, and the refresh_token expiration time should be relatively longer, such as one week.
2.access_token is the user's credential, which expires within 1 hour. After expiration, you can only use refresh_token to obtain a new pair of token,refresh_token. You can only use it once.

what's the point of adding time if token is not random? token has been encrypted and verified in the way you gave it.

the method you said is feasible for small sites, but for large websites, when a large number of users' cache expires, a large number of requests will enter the database, so it is not desirable. My solution is to generate token, assuming that the token is valid for 24 hours, and put the user id and token expiration time into the message queue. The message queue will always cycle to detect users whose token is about to expire. Once it is detected that the token will expire in less than 2 hours, a new token. will be generated immediately. If the site has a large number of users, consider moderately increasing the previous token validity period and 2 hours, or consider a distributed message queuing scheme. In addition, token updates frequently, there is no need for inventory. Okay, I can't make it up anymore.