all working

README.md

@@ -187,6 +187,12 @@ delphi-database/
 - Password hashing with bcrypt
 - Token expiration and refresh
 
+JWT details:
+
+- Access token: returned by `POST /api/auth/login`, use in `Authorization: Bearer` header
+- Refresh token: also returned on login; use `POST /api/auth/refresh` with body `{ "refresh_token": "..." }` to obtain a new access token. On refresh, the provided refresh token is revoked and a new one is issued.
+- Legacy compatibility: `POST /api/auth/refresh` called without a body (but with Authorization header) will issue a new access token only.
+
 ## 🗄️ Data Management
 - CSV import/export functionality
 - Database backup and restore
@@ -194,14 +200,17 @@ delphi-database/
 - Automatic financial calculations (matching legacy system)
 
 ## ⚙️ Configuration
-Environment variables (create `.env` file):
+Environment variables (create `.env` file). Real environment variables override `.env` which override defaults:
 ```bash
 # Database
 DATABASE_URL=sqlite:///./delphi_database.db
 
-# Security  
+# Security
 SECRET_KEY=your-secret-key-change-in-production
-ACCESS_TOKEN_EXPIRE_MINUTES=30
+# Optional previous key to allow rotation
+PREVIOUS_SECRET_KEY=
+ACCESS_TOKEN_EXPIRE_MINUTES=240
+REFRESH_TOKEN_EXPIRE_MINUTES=43200
 
 # Application
 DEBUG=False