The documentation for the configuration you’re looking for is here https://github.com/ueberauth/guardian#jwt-configuration. These options go in the configuration in config.ex

The default TTL (time to live) for the JWT is 4 weeks and I believe you need to manually refresh the token. My post doesn’t detail that aspect

Also have a look at https://github.com/ueberauth/guardian_db for a way to revoke tokens issued.

I’m on a business trip right now, I’ll reply to this when I get some free
time. But in the meantime, look into the Phoenix Fallback Controller
functionality.

Relevant blog ->

https://swanros.com/2017/03/04/action-fallback-contexts-phoenix1-3-tiny-controllers/amp/

Thanks @kokolegorille, based on your idea I have found that the code block needed to handle wrong email address (non existent in DB) is:

def call(conn, :nil) do
  conn
  |> put_status(:unauthorized)
  |> json(%{status: "unauthorized"})
end

@mhanberg, thank you very much. I want to ask, for how long is the token valid? How to configure that setting and does the token refresh / extends its validity the user actively is using it (i.e. does it expire only if it had been idle for some time)