Recipes
Caching strategy
Keep your license checks fast and your origin load low with a layered cache that respects offline grace windows.
Layers
- L1 — In‑memory — hash map keyed by session token, TTL 60 s. Serves 99 % of hot-path lookups.
- L2 — Upstash KV — Redis-compatible, global TTL 300 s. Shared across serverless invocations.
- L3 — KeyAuth origin — canonical source of truth. Only hit on L1 + L2 miss.
Offline grace
When the origin is unreachable, the client falls back to a local HMAC‑signed cache entry valid for 72 h. The signature prevents tampering while the user is air‑gapped.
Invalidation
License revocation propagates in under 5 s via a dedicated KV write on ban events. The L1 cache is purged per‑session using a pub/sub channel.