Node-RED adminAuth and httpNodeAuth credentials lack native expiry or revocation

Goal: Run Node-RED with one least-privilege authentication model across the editor, admin API, and HTTP-in endpoints, and apply credential or token changes without restarting the runtime.

Node-RED secures the editor and admin API through adminAuth, while httpNodeAuth independently guards HTTP-in endpoints. An editor session does not automatically satisfy httpNodeAuth. Tokens under adminAuth.tokens rely on a static secret with no native per-token TTL or revocation. Changing hashes or the token secret in settings.js requires a restart, and the core runtime lacks role-based access control for individual flows or nodes.

Behavior may differ between Node-RED 1.x, 2.x, and 3.x; confirm the installed version before assuming how expiry, revocation, or cross-endpoint authorization works.

• Can adminAuth and httpNodeAuth share one credential store so editor authentication implies least-privilege access to http-in endpoints?
• Is there a supported way to expire or revoke individual adminAuth tokens without changing the shared secret or restarting Node-RED?
• Does current Node-RED provide role-based access control for individual flows or nodes, or must all restrictions come from a custom authentication backend?