A small authorization microservice that runs standalone or inside a federated GraphQL supergraph. It manages devices, the accounts on each device, and service-to-service calls. The encryption key never leaves the server.
What it does
Dual access and refresh tokens, per device, so one phone can hold several accounts and any of them can be signed out remotely.
- Short-lived access tokens on every request, refresh tokens to renew them without interrupting the session
- Device-level identity: track active sessions across devices, revoke one, or sign out everywhere when credentials are compromised
- Profile switching on a single device, with granular sign-out per device or per profile
- Activity monitoring to flag logins from unfamiliar places
What I learned about microservices
They move complexity around more often than they remove it.
Isolating functionality made the first version quick to build and let work happen independently. Operating it was the expensive part: inter-service calls, distributed consistency, versioning, service discovery, and debugging across a network. Kubernetes and Docker help with orchestration, and they bring their own upkeep.
The pattern earns its cost when it lines up with a real business domain and a team that can carry the operational load. Without both, a simpler architecture usually wins.
Tech stack
API
- GraphQL
- Apollo
- Node
- Express
- TypeScript
- Go
Data
- Prisma
- PostgreSQL
Infrastructure
- Docker
- Kubernetes
- AWS