Comment by tyingq

Is the unique endpoint "secure/random" enough? I imagine you would end up with some amount of live session cookies, tokens, api keys, and so on, that would have some value for people guessing uris.

Edit: Ahh, missed the JWT pairing. I read "Pastebin for" too literally.