I'm a newbie in terms of security, but I need a suggestion to make sure the connection between an API and mobile apps is secure. I'm currently using the Laravel framework. Based on its documentation here:
When using hashed API tokens, you should not generate your API tokens during user registration.
The questions are:
- When should the token being generated if it's not during registration?
- Is the token supposed to be generated on every login with specified expiration time?