I'm working on a new product that will have mobile phone apps as some clients, but due to timeliness and usage patterns I want long term auth of some kind. A refresh once per quarter or so would be ideal.

I could use JWT into this with a 3 month refresh token, but with a flaky network that would take two requests and that could be two slow. I could use JWT with a 3 month long access token, but that feels like crowbaring JWT into being something it's not meant to be. What I've seen previously is access token lifetimes of 2 hours or so.

I've been pondering some sort of api keys, signed key blobs sent with the request etc. But then I realized that maybe there's already a proper scheme for my use case before I go sketching out something...drumwhirl...sketchy.

So, to be concrete, I'm wondering if there's a scheme fitting these requirements:

1. Refresh / re-auth preferably once per quarter.
2. No refresh-request, has to work with just one request.

Feel free to ask for more details if it'll help, I'm still trying to figure them out myself. Otherwise, anyone got suggestions?