tokenlifetimes

Token lifetimes refer to the period during which an issued security token remains valid for authentication or authorization. In modern identity systems, tokens such as access tokens, refresh tokens, and ID tokens are used to grant access to resources without re-prompting the user. The lifetime of each token is determined by the issuer and can be affected by policy, client type, and device risk.

Typically, access tokens have short lifetimes (often minutes to an hour) to limit the window of abuse if a token is stolen. Refresh tokens last longer (days to weeks or longer) and are used to obtain new access tokens without re-authenticating. ID tokens indicate authentication and may have their own lifetime, sometimes aligned with access tokens. The expiration time is usually encoded in the token itself as an exp claim or in the token issuance policy.

When an access token expires, clients use a refresh token to request a new access token from the authorization server. Some systems implement refresh token rotation and automatic revocation on reuse to mitigate theft. If no refresh token is available or the user must re-authenticate, the user signs in again.

Long-lived tokens increase risk if compromised. Best practices include keeping access tokens short, protecting refresh tokens with secure storage and using per-device or per-session limits, implementing revocation and rotation, and aligning lifetimes with risk and usability requirements.

Token lifetimes vary by platform and policy. OAuth 2.0 and OpenID Connect define no fixed lifetimes; the authorization server defines them. Enterprises may configure shorter or longer durations and may implement conditional access rules, reflecting a trade-off between security and usability.