Check token settings against your auth standard

About this exercise

Check this token config against your auth standard: RS256 only, access tokens expire in 15 minutes or less, refresh tokens in 30 days or less, signing keys come from the secret store, and the issuer and audience are both checked. List only the settings that break the standard, numbered, as 'setting: current -> required'. Plain text, under 70 words.

Common mistakes when you ask AI for this

• Grading by general best practice. The AI flags sameSite lax or the 30-day refresh token, which your standard allows. Try: Paste your standard and say: "Only flag what breaks it."
• Missing a quiet setting. The AI catches 'none' but skips verifyAudience: false. Try: List every rule, including "issuer and audience both checked."
• Fixes without values. The AI says 'shorten the expiry' without the number. Try: Show the shape: "setting: current -> required."
• Trusting the AI to count words. AI is bad at counting. Ask for "under 70 words" and it often lands well over. Try: Ask for less than the limit and cap each line: "each line under 15 words, under 50 words total."
• Letting markdown in. AI adds bold and headings by default, and in the PR comment they show up as stray symbols. Try: Add: "Plain text only, no bold, no headings."

What a strong prompt includes

• Gives the standard
• Lists only failures
• Shows the line shape
• Sets a word limit
• Asks for plain text

Practice this now ↑

Related exercises

• Add dark mode by overriding your existing CSS variables (Coding AI · Software developers)
• Add input checks to your number guessing game (Coding AI · High school students)
• Add labels to a signup form without rewriting the page (Coding AI · High school students)
• Announce the employee assistance program in three steps (Writing AI · HR and recruiting)
• Answer a cyber insurance form honestly from your notes (Cybersecurity AI · Small business owners)