Design Token Management - System Design | WinJob

Problem Statement & Token Platform Mandate

Design Token Management at Auth0/Okta/AWS scale means operating a dedicated authorization server that mints JWT access tokens and rotating refresh tokens, publishes JWKS, and gives resource servers a fail-closed validation path. This section (mandate) stresses: OAuth2/OIDC issuance and validation at Auth0/Okta scale.

Mechanisms that matter

Active clients: 180K
Peak /token RPS: 42K
Peak validate RPS: 1.2M

Design reasoning (mandate)

Interviewers testing Problem Statement & Token Platform Mandate want proof you separate issuance (slow, consent-heavy) from validation (hot, cache-friendly). State explicit invariants: access tokens are short-lived (15m default), refresh uses rotation with reuse detection, public clients require PKCE S256, and validation never depends on a single JWKS fetch at request time without bounded staleness.

Quantify the slice: Active clients: 180K, Peak /token RPS: 42K, Peak validate RPS: 1.2M. Explain how tenant_id scopes metadata shards while signing keys may be regional but kid must be globally unique. When JWKS rotates, validators must accept dual-kid verify windows before retiring old keys—same pattern as enterprise key rotation, applied to OAuth signing material.

Implementation sketch

javaOne Dark Pro

1 public final class TokenCtx1 {
2   private final String tenantId;
3   private final String clientId;
4   private final long policyVersion;
5   public String cacheKey(String jti, String scope) {
6     return tenantId + "|" + policyVersion + "|" + clientId + "|" + jti + "|" + scope;
7   }
8   public boolean isPolicyStale(long live) { return policyVersion < live; }
9 }

pythonOne Dark Pro

1 from dataclasses import dataclass
2  
3 @dataclass(frozen=True)
4 class TokenCtx1Decision:
5     tenant_id: str
6     client_id: str
7     jti: str
8     scopes: tuple[str, ...]
9     allow: bool
10     rule_id: str

typescriptOne Dark Pro

1 interface TokenCtx1 {
2   tenantId: string;
3   clientId: string;
4   policyVersion: number;
5   jti: string;
6   scopes: string[];
7 }
8 export function denylistKey(c: TokenCtx1): string {
9   return [c.tenantId, c.policyVersion, c.clientId, c.jti].join("|");
10 }

Operational checklist (mandate)

1.1: Monitor mandate — alert when validate p99 exceeds budget during JWKS rotation canary 1.
1.2: Monitor mandate — alert when validate p99 exceeds budget during JWKS rotation canary 2.
1.3: Monitor mandate — alert when validate p99 exceeds budget during JWKS rotation canary 3.
1.4: Monitor mandate — alert when validate p99 exceeds budget during JWKS rotation canary 4.
1.5: Monitor mandate — alert when validate p99 exceeds budget during JWKS rotation canary 5.
1.6: Monitor mandate — alert when validate p99 exceeds budget during JWKS rotation canary 6.
1.7: Monitor mandate — alert when validate p99 exceeds budget during JWKS rotation canary 7.
1.8: Monitor mandate — alert when validate p99 exceeds budget during JWKS rotation canary 8.
1.9: Monitor mandate — alert when validate p99 exceeds budget during JWKS rotation canary 9.
1.10: Monitor mandate — alert when validate p99 exceeds budget during JWKS rotation canary 10.
1.11: Monitor mandate — alert when validate p99 exceeds budget during JWKS rotation canary 11.
1.12: Monitor mandate — alert when validate p99 exceeds budget during JWKS rotation canary 12.

Close mandate with numbers (Active clients: 180K; Peak /token RPS: 42K; Peak validate RPS: 1.2M) and one invariant: never issue long-lived access tokens; push risk into refresh rotation + revocation propagation you can measure.

Why interviewers care

Token Management interviews reward crisp scope, explicit trade-offs, and failure stories—not generic microservice diagrams.

Interview checkpoint

Name one failure story for Problem Statement & Token Platform Mandate that proves you understand real outages, not happy-path diagrams.

Key Highlights

•Active clients: 180K
•Peak /token RPS: 42K
•Peak validate RPS: 1.2M

1	public final class TokenCtx1 {
2	private final String tenantId;
3	private final String clientId;
4	private final long policyVersion;
5	public String cacheKey(String jti, String scope) {
6	return tenantId + "\|" + policyVersion + "\|" + clientId + "\|" + jti + "\|" + scope;
7	}
8	public boolean isPolicyStale(long live) { return policyVersion < live; }
9	}

1	from dataclasses import dataclass
2
3	@dataclass(frozen=True)
4	class TokenCtx1Decision:
5	tenant_id: str
6	client_id: str
7	jti: str
8	scopes: tuple[str, ...]
9	allow: bool
10	rule_id: str

1	interface TokenCtx1 {
2	tenantId: string;
3	clientId: string;
4	policyVersion: number;
5	jti: string;
6	scopes: string[];
7	}
8	export function denylistKey(c: TokenCtx1): string {
9	return [c.tenantId, c.policyVersion, c.clientId, c.jti].join("\|");
10	}