---
status: superseded by ADR-0003
---

# Long-lived device tokens via nodecast-tv fork

nodecast-tv issues JWTs with a 24h expiry, which would force the TV either to
store the user's password in plaintext or to re-prompt daily. We decided to
extend our nodecast-tv fork with non-expiring per-device tokens (API keys
scoped to a user, revocable server-side). The TV logs in once with credentials,
exchanges them for a device token, and never stores the password.
Consequence: the app requires the forked server until the feature is upstreamed.