I’m new to generating authentication flows for REST APIs.

In terms of security, is this authentication flow scalable and efficient for a backend REST API? I do not want to store the blacklisted tokens in the database to ensure fast operations.

Generate Token Pair

1. Client requests token pair by calling /auth/token with user credentials.
2. The backend receives the request and generates the access and refresh token with a session ID in the payload and sends it to the client. In addition to that, the session IDs is stored in the database alongside important client information (user agent, etc.).
3. The client receives the access and refresh token and store them appropriately.

Authenticate Endpoints

1. Client requests a private endpoint with the access token in the header as Bearer.
2. The backend checks payload of token and checks if the session ID is in the blacklist map in Redis. If not, it authenticates the client.

View Logged In Sessions

1. Client requests active sessions from the backend.
2. The backend gets the active sessions from the database and lists them.

Disconnect a Session

1. Client requests to remove a particular session.
2. The backend deletes the session from the database.
3. The backend adds the session ID to the blacklist map in Redis with a TTL same as the token expiry.

Appreciate your feedback and suggestions.

Thanks!