pfSense API package authentication mode token lifetime and revocation differ by version
0 reputation · 15 Nov 2022, 12:45 UTC
The integration must standardize on a single authentication mode for the community pfSense API package so that token handling, refresh logic, and revocation behavior are predictable in production.
The package exposes three auth modes — API token, JWT, and local credentials — but token lifetime, revocation semantics, and header formats shift between package releases. Lab validation on pfSense Community Edition may not reflect behavior on pfSense Plus, and the package is not covered by Netgate support.
Which authentication mode provides the most stable token lifetime and revocation semantics across pfSense API package versions? Does the selected mode behave consistently between pfSense CE and pfSense Plus when the same package version is installed? How should the client handle token refresh or re-authentication when the package is upgraded?
pfsense